A use‑after‑free flaw in the Views component of Google Chrome allows an attacker to run arbitrary code within the browser process. The defect is triggered when a malicious Chrome Extension, installed by the user, accesses memory that has already been freed, enabling code execution.

Any Chrome browser version earlier than 148.0.7778.96 is vulnerable. The issue applies to all operating systems supported by Chrome, including Windows, macOS, and Linux, because no platform‑specific restrictions are listed.

The CVSS score of 7.5 indicates a high technical risk, while the EPSS score is < 1% (approximately 0.00018) and the vulnerability does not appear in CISA’s KEV catalog. Exploitation requires a user to install a malicious or compromised extension, meaning the attack vector is primarily social engineering or compromised download channels. Successful exploitation would grant the attacker code execution capabilities in the context of the Chrome browser process.