A use-after-free bug remote attacker to execute arbitrary code inside the browser’s sandbox by serving a specially crafted HTML page. The flaw is identified as CWE‑416 and delivers code-execution privileges limited to the sandbox but still capable of compromising browser data and potentially allowing further attacks. It is likely that the attack vector involves delivering a malicious HTML document that, when opened in Chrome by a user with the vulnerable extension installed, triggers the use-after-free. The input mentions that the vulnerability can be exploited without user interaction beyond opening the malicious page; however, this inference about the need for a vulnerable stated in the description.

Versions of Google Chrome earlier than 150.0.7871.47 are affected. If the user has not upgraded to the patched version, the browser’s extension system can be triggered by loading a malicious HTML document.

The CVSS score of 8.8 indicates a high severity, though the EPSS score of <1% suggests a low probability of exploitation. The flaw requires a crafted HTML page sent to a user with an active extension; while the sandbox limits system impact, the ability to execute arbitrary code creates a significant threat. It is not listed in CISA KEV and is classified at medium severity by Chromium security.