A use‑after‑free flaw in Chrome’s HTML parser allows an attacker to cause a dangling pointer and execute arbitrary code inside a sandbox. The vulnerability is triggered by a specially crafted HTML page, enabling the attacker to run code with the privileges granted to the browser. This is a memory corruption issue (CWE‑416).

Google Chrome desktop browsers prior to version 155.0.8059.39 are vulnerable. All affected releases below that revision that have not received the update are at risk.

The CVSS score of 8.8 marks this bug as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker delivering a malicious webpage over the internet or through a compromised site. Once the user loads the crafted page, the use‑after‑free leads to code execution within Chrome’s sandbox. Because the flaw does not require privileged access, the risk of exploitation is significant for users who browse malicious content.