A flaw in Chrome’s DevTools module allows an object to outlive its intended lifecycle, giving a malicious extension the ability to craft a payload that corrupts heap memory. The description notes that a user convinced to install a specially crafted extension could potentially exploit this issue. Because the impact involves heap corruption, the potential outcome could be browser instability or, if further leveraged, privilege escalation or arbitrary code execution, though the exact extent is not detailed.

Google Chrome browsers version 145.0.7632.159 or earlier on all major operating systems – Windows, macOS, and Linux. The vulnerability is present across these platforms as part of the Chrome product itself.

The CVSS score of 8.8 signals a high severity, while the EPSS score of less than 1% suggests that, at present, the likelihood of exploitation is low. The flaw is not listed in the CISA KEV catalog, and no public exploits are known. Exploitation requires a user to install a malicious extension, indicating a social‑engineering component. Consequently, the overall risk is moderated by the low attack probability, but the potential impact remains significant if the flaw is successfully leveraged.