Google Chrome prior to 155.0.8059.79 contains a use‑after‑free bug in its SVG processing engine that lets a remote attacker execute code inside the browser sandbox from a crafted HTML page. If an attacker succeeds, the code runs with the same privileges as the browser process, potentially allowing further actions such as escaping the sandbox or accessing local data.

All users running Google Chrome versions earlier than 155.0.8059.79 on Windows, macOS, or Linux are affected. The vulnerability is present in the stable channel before the update noted in the Chrome release notes for 155.0.8059.79.

The CVSS score of 8.8 classifies this as a high‑severity flaw, while the EPSS score of less than 1% indicates a very low probability of exploitation overall. The flaw is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to deliver a malicious SVG inside an HTML page that the victim visits, which can be achieved through phishing or compromised websites. Successful exploitation can lead to arbitrary code execution within the browser process and may allow privilege escalation if sandbox escape is possible.