Use‑after‑free vulnerability exists in the media component of Google Chrome versions earlier than 155.0.8059.39. The flaw allows a remote attacker to execute arbitrary code within the browser sandbox. The weakness, identified as CWE‑416, can be triggered by a specially crafted HTML page that the victim opens. Based on the description, it is inferred that the attacker can place malicious code in the sandbox context, potentially compromising the victim’s system.

Google Chrome 155.0.8059.38 and older on any platform are affected. The vulnerability is present in all operating systems where Chrome is installed, as the affected component is cross‑platform. Users who have not applied the latest stable Chrome update are at risk.

The vulnerability carries a CVSS score of 8.8, indicating high severity. EPSS information is not available, so the exact likelihood of exploitation cannot be quantified, but the absence of an EPSS score does not imply low risk. The issue is not listed in CISA’s KEV catalog. Remote exploitation can occur through a crafted HTML page accessed via normal browsing, making it a viable attack vector for threat actors.