Chrome contains a use‑after‑free flaw in its FullScreen handling that allows a crafted HTML page to trigger execution of arbitrary code outside the browser sandbox. The flaw can be triggered by a remote attacker, giving them control equivalent to the user’s account and eliminating the protection normally afforded by the sandbox. The consequence is full system compromise, leading to data theft, tampering, or additional malware deployment.

All installations of Google Chrome before version 154.0.8037.92 are vulnerable, regardless of operating system. This includes the stable desktop channel and potentially any custom builds using the affected Chromium code.

The vulnerability receives a CVSS score of 9.6, indicating a high likelihood of severe impact. No EPSS score is available, and the issue is not currently listed in CISA’s KEV catalog, but the nature of the flaw—remote exploitation via a crafted web page—makes it an attractive target for attackers. The attack vector is a remote, user‑initiated web page, meaning the attacker can surface the exploit through malicious websites or phishing campaigns. Given the high CVSS, users should treat this flaw as a top‑priority risk.