A use‑after‑free bug in the JavaScript bindings of Google Chrome allows a remote attacker, by serving a specially crafted HTML page, to execute arbitrary code within the browser’s sandbox. The flaw arises when the browser frees memory that is still referenced, enabling the attacker to control program flow and run malicious payloads. The primary consequence is loss of data confidentiality and integrity for the user’s browsing session and the potential for further escalation if the sandbox can be bypassed.

The vulnerability affects Google Chrome versions before 155.0.8059.39. Any installation of Chrome that has not applied the October 2026 stable channel update that contains the fix is vulnerable. The impact applies regardless of operating system, as the flaw resides in the cross‑platform browser code.

The CVSS score of 8.8 indicates high severity and the lack of an EPSS rating means we cannot quantify current exploitation likelihood, although no exploitation reports exist yet. The bug is not listed in CISA’s KEV catalog. Exploitation requires a user to load a malicious web page; standard defense in depth remains effective if the browser sandbox is maintained. The risk is primarily to end users browsing untrusted content.