A type confusion bug within the CSS engine of Google Chrome could allow a malicious browser extension, obtained by convincing a user to install it, to corrupt the heap. Such corruption can destabilize the browser process or provide a foothold for further exploitation, compromising memory safety of the browser's core components.

Chrome versions before 147.0.7727.55 on desktop platforms are vulnerable. Users of the stable channel should install the 147.0.7727.55 update or later to eliminate the issue.

The vulnerability carries a low Chromium severity rating and is not included in the KEV catalog; no EPSS score is available. Exploitation requires a malicious extension and user interaction to install it. Since the bug involves heap corruption, successful exploitation could lead to memory corruption within the browser, potentially enabling arbitrary code execution in the context of the compromised process, but the overall risk remains low under current conditions.