This vulnerability involves a use-after-free condition in the Extensions component of Google Chrome before version 148.0.7778.216. An attacker with control over the renderer process could leverage this flaw to perform a sandbox escape via a specially crafted Chrome extension. The vulnerability is rated critical with a CVSS 3.1 base score of 9.0, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The issue is addressed in the Chrome stable channel update referenced in the vendor advisory.

Successful exploitation could allow a remote attacker who has compromised the renderer process to escape the Chrome sandbox, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No public exploits have been reported so far.

A fix is available in Google Chrome version 148.0.7778.216. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for detailed patch information and update instructions.