A use-after-free flaw exists in the handling of user passwords within Google Chrome. The vulnerability can be triggered by a maliciously crafted HTML page that causes the browser to free memory and then access the deallocated region, allowing arbitrary code execution outside the browser’s sandbox. With a CVSS score of 9.6, this flaw provides attackers the ability to compromise system integrity by running code as the Chrome process, potentially extending to wider system compromise.

Any system running Google Chrome versions prior to 154.0.8037.92 is affected, regardless of operating system. The workaround is not vendor supplied, so the only mitigation is to upgrade to the fixed release.

The flaw carries a very high rating and is believed to be exploitable via a remote attacker who can serve the crafted page. The EPSS score is not available, so no concrete data exist on the current exploitation probability, but the lack of a KEV listing indicates no publicly known exploitation at this time. The CVSS score reflects the severe impact if the vulnerability is leveraged successfully. Attackers would need Internet access to the vulnerable browser and a means to load the malicious page, such as social engineering or compromised advertising networks.