The vulnerability is a use‑after‑free inside the Network module of Chrome versions prior to 155.0.8059.39. A malicious crafted extension can trigger the freed memory to be accessed, allowing a remote attacker to execute arbitrary code outside of Chrome’s sandbox. The weakness is a classic use‑after‑free (CWE‑416) that compromises the integrity and confidentiality of the user’s system.

The flaw affects Google Chrome running on desktop platforms. Versions before 155.0.8059.39 are vulnerable, leaving all users of that release exposed regardless of operating system. The impact is possible remote code execution via a social‑engineering attack using a crafted Chrome extension.

With a CVSS score of 9.6 the vulnerability is critical. The EPSS score is not available, but the lack of a KEV listing indicates it has not yet been observed with widespread exploitation. The attack vector is likely social engineering: an attacker would convince a user to install a malicious extension that contains the crafted payload. If successful, the attacker can bypass the sandbox and take full control of the host. The exploit requires user interaction to install the extension, but once installed, no additional privileges are needed.