The CVE describes a use‑after‑free bug in Chrome’s password handling that lets an attacker who has already compromised the renderer process execute code outside the browser sandbox. The flaw is triggered by a crafted HTML page and can lead to arbitrary code execution with elevated privileges on the host system.

Google Chrome versions prior to 155.0.8059.79 are vulnerable. The issue is fixed in 155.0.8059.79 and later releases, which remove the broken memory reference in the password subsystem.

The CVSS score of 8.3 indicates a high‑severity issue, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker must already have control of the renderer process, typically achieved through malicious web content. If this condition is met, the exploit can bypass the sandbox and execute code on the host system.