This vulnerability arises from insufficient validation of untrusted input within Google Chrome extensions in versions before 151.0.7922.72. An attacker could exploit this by tricking a user into installing a malicious extension, which could then execute a sandbox escape, potentially compromising the browser's security boundaries. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix is included in Chrome version 151.0.7922.72.

Successful exploitation could allow an attacker to escape the Chrome sandbox via a malicious extension, leading to full compromise of the browser environment. This includes potential unauthorized access to sensitive data, modification of browser behavior, and disruption of availability. The vulnerability requires user interaction in the form of installing a malicious extension but does not require prior privileges.

Users and administrators should update Google Chrome to version 151.0.7922.72 or later, where this vulnerability is patched. No other mitigations are specified by the vendor advisory. Since this is a client-side vulnerability requiring user installation of a malicious extension, caution should be exercised when installing extensions from untrusted sources.