A use‑after‑free flaw in the Picture‑in‑Picture implementation of Google Chrome allows a remote attacker who has already compromised the renderer process to execute code outside of the browser sandbox. The vulnerability arises from improper memory deallocation, a classic violation of CWE‑416, and is further aggravated by uninitialized or incorrectly handled data as described by CWE‑825. If exploited, the attacker could run arbitrary code with the privileges of the renderer process, thereby compromising the host system’s confidentiality, integrity, and availability.

Google Chrome builds before version 154.0.8037.92 on every platform are affected. This includes Windows, macOS, Linux, Chrome OS, and any derivative browsers that include the Chromium engine in the same state without the patch. All users running the stable, beta, or dev channels of Chrome prior to the published update are exposed.

The CVSS score of 8.3 classifies the flaw as high severity, yet the EPSS score is not available, leaving the precise exploitation likelihood uncertain. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a remote web‑based exploit: the attacker must serve a malicious HTML page that triggers the use‑after‑free within a compromised renderer process, typically requiring user interaction or a prior malicious compromise. Given the high impact and the sandbox escape potential, the threat remains non‑negligible for all users of the affected Chrome releases.