This vulnerability is a use‑after‑free flaw in Chrome’s Tint layer rendering code. The flaw can be triggered by a carefully crafted HTML page and allows a remote attacker who can cause the page to be processed to potentially execute arbitrary code outside the Chrome sandbox. The issue is marked as high severity by the Chromium security team because it undermines the basic isolation that the browser enforces for third‑party content.

Google Chrome is affected. The flaw exists in all releases prior to Chrome 155.0.8059.39, including stable, beta, and dev channels before that version. Users running earlier releases are at risk until they upgrade to the patched version.

The CVSS score of 9.6 highlights a high impact. EPSS data is not available for this CVE, and it has not been added to the CISA KEV catalog. Because the flaw is triggered by an external HTML page, the attack vector is remote and does not require local privileges. A successful exploitation would give the attacker code‑execution rights with the same privileges as the Chrome process, potentially bypassing the sandbox. The lack of a published workaround means that the only known defense is to apply the vendor update before engaging with untrusted content.