The vulnerability is a use‑after‑free in Chrome extensions that allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation can give the attacker control over the Chrome process and, depending on the privileges of the sandbox, can lead to privilege escalation or theft of user data. The flaw is a classic use‑after‑free (CWE‑416) and a memory safety issue indicated by CWE‑825.

Google Chrome versions prior to 151.0.7922.72 are affected. The vulnerability applies to all Chrome releases that include the extensions framework and is not limited to a specific operating system.

The CVSS score of 8.8 marks this as high severity. The EPSS score of less than 1 % indicates the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector requires a malicious Chrome extension, which means that an attacker must convince a user to install the extension or supply it via an existing extension. If this occurs, arbitrary code execution is achieved within the sandbox, creating a serious risk to confidentiality, integrity, and availability of the user’s data and system.