The vulnerability is a use‑after‑free in Chrome’s FileSystem API that permits a remote attacker to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. This flaw can lead to full compromise of the host operating system, exposing the confidentiality, integrity, and availability of all data and services on the compromised machine.

All Google Chrome installations built before 155.0.8059.79 are affected, regardless of operating system. The flaw exists in every build that incorporates the vulnerable FileSystem implementation at the time of disclosure.

The CVSS score of 9.6 marks the vulnerability as critical, but the EPSS score of less than 1 % indicates a low current exploitation probability. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is a malicious web page that a user open or visits, delivering the crafted HTML while Chrome renders it. The flaw can be exploited remotely without authentication, and the attacker can run any code at the user’s privilege level as soon as the page is loaded.