Google Chrome contains a use‑after‑free flaw in the Metrics component. This weakness, identified as CWE-416, permits an attacker who has already compromised a renderer process to run arbitrary code at the level of the Chrome user profile and escape the sandbox. Consequently, an exploited system could be fully compromised, granting the attacker control over data and possibly the host OS.

It is inferred that the vulnerability affects all desktop installations of Google Chrome prior to 155.0.8059.39, across Windows, macOS, and Linux. Users on stable channel releases before that build are vulnerable; it is inferred that disabling the Metrics feature is a containment measure.

The CVSS score of 8.3 signals a high severity vulnerability. The EPSS score is not available, and the bug is not listed in the CISA KEV catalog, indicating no public exploitation evidence yet. It is inferred that the flaw requires an attacker to first compromise a renderer process; based on the description, it is inferred that the likely attack vector is compromised renderer processes, which could arise through phishing, drive‑by downloads, or malicious local content—all inferred from typical renderer compromise methods. Once that foothold is achieved, delivering a crafted HTML page can trigger the use‑after‑free, enabling code execution outside the sandbox—an attack that is classically both remote in nature and simple to execute once the initial renderer compromise is achieved. The outlined attack chain suggests several points of failure but also multiple vectors for an adversary, making the risk significant for users who run unpatched Chrome.