The vulnerability is a use‑after‑free condition in Google Chrome extensions that can corrupt the heap when a user installs a malicious extension and then visits a crafted HTML page. If successfully exploited, an attacker could gain the ability to execute arbitrary code on the affected system.

All platforms where Google Chrome is installed—Windows, macOS, and Linux—are affected for any Chrome release earlier than version 146.0.7680.71. The vulnerability only applies to Chrome, not to the underlying operating system kernels.

The CVSS score of 8.8 indicates a high severity attack that would allow code execution remote from the attacker’s point of view, though the EPSS score is below 1%, implying a low likelihood of exploitation in the wild as of the last analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires a user to install a malicious extension and then visit a specially crafted web page; thus it is an elevated user‑initiated threat that can be mitigated by controlling the trustworthiness of extensions and by staying up‑to‑date with Chrome patches.