The vulnerability arises from a use‑after‑free bug in the WebAudio implementation of Google Chrome before version 155.0.8059.39. A maliciously crafted web page can trigger the dangling pointer and execute arbitrary code within the browser’s sandboxed process. Because the code runs inside the sandbox, an attacker can potentially exfiltrate data or perform further attacks after escaping the sandbox, resulting in remote code execution.

The weakness affects Google Chrome across all platforms that deploy the affected WebAudio engine. All users running versions older than 155.0.8059.39 are susceptible until the patch is applied. The vendor‑issued update removes the use‑after‑free condition.

With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score is not available, and the flaw is not currently listed in the CISA KEV catalog. Because the defect can be triggered by a crafted HTML page delivered over the internet, the likely attack vector is a remote web‑based exploitation. Exploitation requires no local privileges; the attacker relies solely on a victim visiting the malicious page, making it a classic remote code execution scenario.