The CVE details a use‑after‑free flaw in Google Chrome’s handling of the HTML <select> element. A crafted page can trigger memory corruption when the select control is manipulated, allowing an attacker to execute arbitrary code with the privileges of the sandboxed Chrome process. This can lead to the disclosure of local data and enable the attacker to take control of the browser session.

All Google Chrome builds prior to 155.0.8059.39 on desktop platforms are affected. The advisory links describe a stable channel release that addressed the vulnerability, meaning any Chrome version older than this release remains vulnerable across operating systems.

The flaw carries a CVSS score of 8.8 and is not listed in the CISA KEV catalog. While EPSS data is unavailable, the bug can be triggered by simply visiting a malicious HTML page that social‑engages a user, indicating a realistic exploitation risk. Until the patch is applied, the vulnerability should be treated as a high‑exposure threat.