A race condition was discovered in Chrome’s DevTools component that can corrupt internal objects when a user performs specific UI gestures and installs a malicious extension. The corrupted objects could then be leveraged by an attacker to trigger unintended behavior, potentially resulting in remote code execution or data compromise. The vulnerability is categorized as Medium severity by Chromium’s internal assessment.

The flaw exists in all Google Chrome releases earlier than 145.0.7632.45, regardless of operating system. Users running Chrome on Windows, macOS, or Linux are therefore affected as indicated by the provided CPE entries.

The CVSS score of 7.5 indicates a high severity level. An EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path requires a remote actor to influence a user into engaging in particular UI interactions and installing a malicious extension, which then triggers the race condition. While the exploitation route is indirect and user-dependent, the potential impact warrants attention.