A use after free flaw in PerformanceManager occurs when the renderer process frees an object that is still referenced, allowing a malicious actor with control over the renderer to read or write arbitrary memory. This can lead to a sandbox escape, giving the attacker the ability to execute code outside the renderer’s restricted environment and potentially compromise the entire system. The weakness is classified as CWE‑416 and CWE‑825, a memory‑management issue that permits misuse of freed memory.

Google Chrome versions before 148.0.7778.216 are affected. Users running the stable desktop channel of Chrome that has not yet updated past this build are at risk. Later releases in Chrome’s stable, beta, and dev channels include the fix and are not vulnerable.

The vulnerability has a CVSS score of 8.3, a high severity rating, and is not listed in the CISA KEV catalog, indicating that active exploits are not widely reported. Its exploitability relies on an attacker being able to deliver a crafted HTML page to a renderer process that has already been compromised, which is a realistic scenario in the context of web browsing or malicious extensions. The EPSS score of < 1% indicates a very low exploitation probability, but the potential for sandbox escape gives the vulnerability a high overall risk. Prompt remediation is advised.