The vulnerability is a use‑after‑free flaw in the Document Object Model of Google Chrome. By delivering a specially crafted HTML page, a remote attacker can cause the browser to execute code that has already been freed from memory. If successful, the attacker gains the ability to run arbitrary code inside the Chrome sandbox, potentially enabling further compromise of the host system.

Google Chrome browsers whose build version is older than 148.0.7778.216 are affected. All installations of this product that use a prior build are vulnerable; the CVE does not specify any particular operating system or platform.

Chromium labels the flaw as high severity, reflected in a CVSS score of 8.8. The EPSS score indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that attackers can deliver malicious HTML via a remote connection, such as an email attachment or a compromised web page, making the attack vector remote. Because execution occurs within the sandbox, the potential damage depends on the sandbox configuration, but arbitrary code execution remains a high‑risk outcome.