Chrome extensions that use a renderer process are susceptible to a use‑after‑free flaw (CWE‑416). An attacker who has already compromised the renderer can trigger the free memory reuse, enabling a sandbox escape and run arbitrary code. The vulnerability is categorized by Chromium as High severity. Because the flaw allows execution of code outside the browser sandbox, it can potentially expose sensitive system data and compromise host integrity.

All users of Google Chrome on the desktop whose browsers are below version 149.0.7827.103 are affected. The problem was fixed in the 149.0.7827.103 release announced in early June 2026.

The risk is high. While the EPSS score is not available, the Chromium severity assessment of High indicates significant potential impact. Exploitation requires an attacker who already controls the renderer process, which can be achieved through a malicious extension or compromised webpage. The vulnerability is not currently listed in CISA’s KEV catalog, suggesting no known active exploits in the wild yet, but the lack of an EPSS score does not reduce the threat of targeted attacks using this flaw.