A use‑after‑free flaw exists in Chrome’s Media implementation before version 155.0.8059.79. The vulnerability allows a remote attacker to execute arbitrary code inside the browser’s sandbox by delivering a specially crafted HTML document. The impact manifests as code execution with the privileges granted to the browser process, potentially enabling a sandbox escape if additional vulnerabilities exist. The weakness is a classic use‑after‑free error, identified as CWE‑416.

Google Chrome builds older than 155.0.8059.79 on all supported platforms are affected, covering Windows, macOS, Linux, and Chrome‑based browsers. Users interacting with the vulnerable version can be exploited when they visit malicious content.

The CVSS score of 8.8 indicates a high‑severity vulnerability, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely a malicious HTML page that a user opens or visits, allowing a crafted Media payload to trigger the use‑after‑free. If successful, the attacker gains sandboxed code execution and could potentially expand privileges if other escape mechanisms are present.