A use‑after‑free vulnerability in the Skia graphics library used by Google Chrome allows a remote attacker who has already compromised the renderer process to trigger a sandbox escape. The flaw uses the freed memory of a Skia object and can be triggered by a specially crafted HTML page sent to the renderer, potentially enabling the attacker to execute code with higher privileges than the renderer process. Because the renderer is sandboxed, escaping the sandbox would undermine Chrome’s core security boundary and could lead to full system compromise on the affected platform.

All installations of Google Chrome older than version 148.0.7778.216 are vulnerable. No specific operating system distribution is singled out in the advisory, so the risk applies universally to Chrome users on Windows, macOS, Linux, and any other platform that runs the affected browser build.

The CVSS score is 8.3, indicating high severity. No publicly available exploit is known, and the EPSS score is < 1%, indicating a very low likelihood of immediate exploitation. However, if an attacker is able to compromise the renderer—either by exploiting another vulnerability or through user‑interaction—then this defect offers a path to escape the process sandbox and could lead to arbitrary code execution on the host. The vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited in the wild.