This vulnerability is a use‑after‑free flaw located in the password handling component of Google Chrome. When a renderer process is compromised, an attacker can trigger the flaw by serving a specially crafted HTML page that causes a freed memory object to be accessed again, allowing the attacker to execute arbitrary code outside the browser sandbox. The result is a full break of the sandbox both in integrity and confidentiality of the system.

The flaw affects Google Chrome versions before 155.0.8059.79. Affected users running any earlier stable channel may be vulnerable. The remedy is to upgrade to Chrome 155.0.8059.79 or a later version where the issue has been fixed.

The CVSS score of 8.3 indicates a high severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, requiring the attacker to supply a malicious HTML page to a compromised renderer process. Successful exploitation would allow full control over the user's machine by bypassing the sandbox.