A use‑after‑free bug in Chrome’s CSS engine allows a remote attacker to execute arbitrary code inside the browser sandbox via a specially crafted HTML page. The flaw, identified as CWE‑416, gives the attacker the ability to run memory‑corrupting code once the vulnerable CSS code path is triggered.

Google Chrome on all operating systems, versions prior to 155.0.8059.39, are susceptible to exploitation through malicious HTML content.

The vulnerability carries a low severity score in Chromium’s own internal rating and no EPSS value is reported, but because it permits remote code execution, attackers could achieve full sandbox escape if users open a malicious page. The CVSS score of 8.8 classifies it as high severity, indicating a serious risk. The lack of a KEV listing suggests no active widespread exploitation currently, yet any user visiting a crafted HTML page could be compromised.