This vulnerability involves a use-after-free bug in the V8 JavaScript engine component of Google Chrome before version 148.0.7778.96. Exploitation requires user interaction in the form of installing a crafted malicious Chrome extension, which then enables arbitrary code execution within the sandbox environment. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The issue is publicly disclosed and patched in the referenced stable Chrome update.

Successful exploitation can lead to arbitrary code execution inside the Chrome sandbox, potentially compromising the confidentiality, integrity, and availability of the affected system. Since exploitation requires user installation of a malicious extension, the attack vector depends on social engineering. There are no reports of active exploitation in the wild.

A fixed version of Google Chrome (148.0.7778.96 or later) is available as per the vendor's stable channel update advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html). Users and administrators should update to this version or later to remediate the vulnerability. No other mitigations are specified by the vendor.