This vulnerability involves a use-after-free condition (CWE-416) in the V8 engine component of Google Chrome before version 147.0.7727.55. An attacker who persuades a user to install a crafted malicious extension could trigger heap corruption, potentially leading to arbitrary code execution or other impacts. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. The vulnerability is addressed in Chrome version 147.0.7727.55 and later.

Successful exploitation could result in heap corruption, allowing an attacker to execute arbitrary code within the context of the browser. This compromises confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction in the form of installing a malicious extension. There are no reports of active exploitation in the wild at this time.

A fix is available in Google Chrome version 147.0.7727.55 and later. Users and administrators should update to this version or newer to remediate the vulnerability. The vendor manages remediation for this desktop browser update; applying the official stable channel update is the recommended action. No additional mitigations are specified in the vendor advisory.