This vulnerability is a use‑after‑free error in the views component of Google Chrome, allowing a remote attacker to run arbitrary code outside the browser sandbox by delivering a specially crafted HTML page. The flaw, classified as CWE-416 and CWE-825, can lead to full system compromise if the attacker can persuade a user to load the malicious page, as it does not require elevated privileges within the browser sandbox. The attack hinges on a social engineering vector, but once triggered, the impact is high. The vendor rates its Chromium severity as High.

Google Chrome versions prior to 154.0.8037.92 are affected. The flaw occurs within the views module of the browser. No other products are listed as impacted.

The CVSS score of 9.6 denotes a severe risk, indicating that successful exploitation could result in complete system compromise. The EPSS score, 0.0031, indicates a low probability of exploitation. The vulnerability is not registered in CISA’s KEV catalog, suggesting no known mass exploitation at this time. The likely attack path involves a local user opening a malicious HTML page that is crafted to trigger the use‑after‑free condition; the attacker can then execute arbitrary code outside the sandbox. The high urgency and lack of mitigation guidance apart from a patch imply that the risk remains significant until updated versions are applied.