Use after free in the Chrome Browser component allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The flaw, classified as CWE-416, can bypass Chrome’s sandbox boundaries and run code with the user’s privileges or potentially gain higher access on the host. Based on the description, it is inferred that successful exploitation could lead to complete compromise of the affected machine, threatening confidentiality, integrity, and availability.

Google Chrome versions prior to 155.0.8059.79 on all supported platforms are affected. The weakness is fixed in Chrome 155.0.8059.79 and later releases provided by Google. The affected product is Google:Chrome.

The CVSS score of 9.6 indicates a high severity for remote code execution. The EPSS score of less than 1% shows a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is remote and a malicious webpage delivered to a user could trigger the flaw. Because the flaw allows code execution outside the sandbox, a successful exploit could give the attacker full control over the host system.