A use-after-free flaw in Chrome extensions allows an attacker who convinces a user to install a malicious extension to gain execution of arbitrary code within the browser’s sandbox. The problem arises when the browser frees an object and later accesses it, violating memory safety and granting the attacker a window to execute arbitrary payloads. The vulnerability is classified as CWE‑416 and is noted by Chromium as high severity.

Google Chrome, versions prior to 151.0.7922.109, are susceptible. Clients using any older stable channel update that does not include the patch may be exposed.

The vulnerability’s impact is confined to the user who installs the malicious extension, but it can be leveraged for broader compromise if the extension acts as a foothold for further attacks. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Because exploitation requires the user to install a malicious extension, the attack vector depends on social engineering. The high Chromium severity indicates that a successful exploit could lead to compromised confidentiality or integrity of user data and potentially the host system if the sandbox is bypassed.