A use‑after‑free flaw in the Views component of Google Chrome allows an attacker to execute arbitrary code in the browser process. The vulnerability is triggered when a malicious Chrome Extension, installed by the user, causes the freed memory to be accessed again. This flaw, identified as CWE‑416, can compromise confidentiality, integrity, and availability of the affected system.

Google Chrome browsers running any version earlier than 148.0.7778.96 are affected. The issue is present on all operating systems supported by Chrome, as no platform‑specific version restrictions are listed.

Chromium rates this vulnerability as medium severity. EPSS data is not available and the flaw is not listed in the CISA KEV catalog. The attack requires a user to install a malicious or compromised extension, so the vector is primarily social engineering or compromised extension downloads. Successful exploitation would give code execution capabilities within the browser’s process context.