Use after free in Chromium’s media pipeline allows an attacker to execute arbitrary code within the renderer process sandbox by loading a specially crafted HTML file. The vulnerability arises from a memory corruption bug that frees and later reuses a buffer, leading to execution of injected code. The weakness is classified as CWE‑416 and is marked critical by Chromium security teams.

The flaw affects all builds of Google Chrome that precede version 155.0.8059.79, regardless of operating system. This includes Windows, macOS, Linux, and ChromeOS users running older releases. No specific sub‑versions or platform nuances are mentioned beyond the overall version number, so the entire set of older Chrome builds is impacted.

With a CVSS base score of 8.8 the vulnerability is considered high severity, and the EPSS score of <1% indicates a very low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through a malicious HTML page served over HTTP or HTTPS that the victim opens in Chrome; no extra user interaction beyond viewing the page is required. Because code execution is confined to the sandboxed renderer, additional sandbox‑escape techniques would be needed for system‑wide compromise, which may reduce the overall risk but still permits code execution inside the browser process.