The vulnerability is a use‑after‑free in Chrome’s DevTools that an attacker can abuse by creating a crafted Chrome Extension. When a user installs the malicious extension, the extension code can execute arbitrary code within the sandbox that the extension runs in. The attacker could use this capability to perform further malicious actions such as exfiltrating data, installing additional malware, or escalating privileges relative to the sandboxed environment. The weakness is identified as CWE‑416 and CWE‑825.

Affected systems include Google Chrome browsers running any version prior to 151.0.7922.72 released in July 2026. The security bulletin lists the affected channel as the stable desktop release. All installations of Chrome that have not yet applied the July 2026 stable update are vulnerable.

The CVSS score is 7.5, indicating a high severity. The EPSS score of less than 1% shows a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack would require the user to be convinced to install a malicious extension, which is a social‑engineering prerequisite. Therefore the risk is moderate; however, the potential for arbitrary code execution warrants prompt mitigation.