This vulnerability is a standard use‑after‑free flaw (CWE‑416) that can be triggered in the extensions subsystem of Google Chrome when the renderer process has already been compromised. When the flaw is exercised, a maliciously crafted HTML page can cause the renderer to access freed memory, potentially allowing the attacker to break out of the process sandbox and execute code with elevated privileges on the host operating system. The impact is a loss of isolation between sandboxed web content and the rest of the system, leading to potential full system compromise if an attacker exploits the flaw.

All users running Google Chrome versions earlier than 149.0.7827.155 are affected. The flaw resides in the extensions handling code and affects every installation that enables Chrome extensions on the affected release channel. Specific versions listed in the CNA are only the affected minimum, implying that earlier releases include the same vulnerability.

The CVSS score is 8.3, indicating high severity, while the EPSS score is below 1%, showing a very low but nonzero likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The attack vector is inferred to require a remote attacker who can influence the renderer process, such as through malicious web content or a compromised extension, and then deliver a crafted HTML page that triggers the use‑after‑free exploit.