The vulnerability is a use‑after‑free bug in the DOM implementation of Google Chrome. When a crafted HTML document is rendered, an object that has already been freed can be accessed, allowing a remote attacker to execute arbitrary code inside the browser’s sandbox. This flaw can lead to loss of confidentiality, integrity, and potentially availability of the affected system.

All installations of Google Chrome running a version prior to 155.0.8059.79 on any platform are affected. Users who have not applied the October 2026 stable channel update remain vulnerable.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog and no active exploitation is known. An attacker would need to lure a user into opening a malicious HTML page or delivering a crafted file; the exploit occurs within the browser context and, if successful, can escape the sandbox to execute arbitrary code with the user’s privileges.