This vulnerability arises from an inappropriate implementation in the ServiceWorker component of Google Chrome before version 148.0.7778.96. An attacker can exploit this by tricking a user into installing a crafted malicious Chrome extension, which then enables injection of arbitrary scripts or HTML content, leading to UXSS. This could potentially allow the attacker to bypass same-origin policies within the browser context. The issue is recognized and published by Google, with a vendor advisory available, but explicit patch status is not confirmed in the provided information.

Successful exploitation allows an attacker to inject arbitrary scripts or HTML via a malicious Chrome extension, potentially leading to UXSS attacks. This can compromise the security boundaries within the browser, possibly allowing unauthorized script execution in the context of trusted web pages. However, no known exploits in the wild have been reported at this time.

The vendor advisory URL is provided but does not explicitly confirm patch availability or remediation steps in the given data. Users should update Google Chrome to version 148.0.7778.96 or later, as the vulnerability affects versions prior to this. If unable to update immediately, users should avoid installing untrusted or unknown Chrome extensions to mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.