Use after free in the Storage component of Google Chrome before version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox through a crafted HTML page. The vulnerability is a classic use‑after‑free error that leads to remote code execution, providing the attacker with full control over the victim’s system. It falls under CWE‑416, indicating an improper use of freed memory.

Google Chrome versions earlier than 155.0.8059.39 are affected. The bug exists in the Storage module of the browser by Google. Any user running these unpatched versions on any supported operating system is at risk, including Windows, macOS, and Linux distributions.

With a CVSS score of 8.3, the vulnerability is considered high severity. The EPSS score is not available, so the precise exploitation probability is unknown, but the lack of inclusion in CISA's KEV catalog suggests no widely used exploit yet. The attack requires the attacker to first compromise the renderer process, likely by delivering a malicious HTML page or exploiting another vulnerability, and then exploit the use‑after‑free to escape the sandbox. If successful, arbitrary code could execute with renderer privileges, potentially escalating to higher privileges via further exploitation.