This vulnerability is a use‑after‑free error in the TabStrip component of Google Chrome prior to version 155.0.8059.39. An attacker who successfully navigates a victim to a crafted HTML page can trigger the flaw, leading to arbitrary code execution outside of Chrome's sandbox. The flaw is classified as a high‑severity issue, meaning that a local or remote exploit could compromise system confidentiality, integrity, and availability by executing malicious code with elevated privileges.

The affected product is Google Chrome for desktop users. Versions older than 155.0.8059.39 are vulnerable. The official advisory from Google recommends updating to the new stable channel release that includes the patch.

Because the exploit requires a victim to open a malicious HTML page, the attack vector is remote social engineering. No EPSS score is currently available, and the vulnerability is not listed in CISA's KEV catalog. However, given its high severity (CVSS 9.6) and the fact that it allows code execution outside the browser sandbox, the risk is significant for exposed users. An attacker could gain local system privileges after convincing a user to visit a malicious site. There is no publicly documented proof of concept, but the combination of a use‑after‑free bug and sandbox escape suggests a high likelihood that interested threat actors may develop an exploit.