An inappropriate implementation in the V8 JavaScript engine of Google Chrome permits an attacker who can persuade a user to install a malicious Chrome extension to execute arbitrary code inside the browser’s sandbox. This flaw, identified as CWE‑269 and CWE‑551, enables the attacker to bypass sandbox restrictions and run code that may read or modify data or otherwise compromise the user’s system, representing a significant breach of confidentiality, integrity, and availability.

Google Chrome users running versions earlier than 151.0.7922.72 on any platform that supports Chrome are vulnerable. The exploit requires the victim to install an extension from an untrusted source; once installed, the malicious code runs with the privileges granted to the extension.

The CVSS score of 7.5 indicates moderate to high severity, while an EPSS score of less than 1% signals a very low probability of real‑world exploitation, and the issue is not present in the CISA KEV catalog. The attack vector is user interaction via social engineering; an attacker convinces a user to install a malicious extension, and upon installation the vulnerability is immediately exploitable, allowing code execution within the sandbox with little additional effort.