This vulnerability involves a use-after-free condition in the ServiceWorker implementation of Google Chrome before version 149.0.7827.53. Exploitation requires user interaction in the form of installing a crafted malicious Chrome extension, which can then lead to arbitrary code execution. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CWE-416 (Use After Free).

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected browser, potentially leading to full compromise of the user's browsing environment. This can result in data theft, system compromise, or further malicious activity. The vulnerability requires user interaction (installing a malicious extension), which limits the attack vector but still poses a significant risk.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor this advisory for updates and apply any official fixes once available. Until then, avoid installing untrusted Chrome extensions to reduce risk.