A use-after-free flaw in the TabStrip component of Google Chrome allows a remote attacker to execute arbitrary code when a specially crafted Chrome extension is installed. The vulnerability, classified as Medium severity by Chromium, can enable malicious code to run outside of the browser sandbox, potentially compromising the host system's integrity or confidentiality.

Google Chrome desktop browsers prior to version 157.0.8103.38 are affected. Users of newer releases are not impacted.

The flaw requires the attacker to supply a malicious extension. Because the extension mechanism is user‑initiated, the risk of exploitation depends on the user installing a malicious extension. EPSS data is not yet available, and the vulnerability is not listed in the CISA KEV catalog. The medium severity rating reflects the potential for code execution if an extension is crafted maliciously.