A use‑after‑free defect in Chrome’s extension handling can corrupt heap memory when a user installs a malicious extension. The flaw, identified by CWE‑416 and CWE‑825, may allow an attacker to manipulate memory structures and potentially execute arbitrary code on the victim’s machine.

Google Chrome versions earlier than 146.0.7680.153 are vulnerable. The issue affects all operating systems that Chrome runs on—including macOS, Linux, and Windows—as indicated by the corresponding CPE entries.

The vulnerability receives a CVSS score of 8.8, placing it in the high‑severity range. An EPSS score below 1 % indicates a low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack path requires the user to install a malicious extension, after which the use‑after‑free condition can be triggered to corrupt heap memory and facilitate code execution.