A use‑after‑free vulnerability in the Media components of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox through a crafted HTML page. Because the vulnerable code runs in a sandboxed renderer process, the attacker can achieve code execution with the same privileges as the browser, potentially compromising the user’s system. This flaw is classified as CWE‑416 and given a high severity in Chromium’s release notes.

All installations of Google Chrome prior to version 155.0.8059.79 are impacted. The vulnerability is present in the stable channel releases before that build and affects all operating systems that ship this Chrome version, including Windows, macOS, and Linux.

The CVSS score of 8.8 indicates high risk, and the EPSS score of < 1% suggests that active exploitation is rare today. However, the flaw is listed as not in CISA’s KEV catalog, meaning no widespread incidents are currently reported. The likely attack vector is through a malicious web page that the user visits, which triggers the exploit in the Media code path and causes a memory corruption leading to a sandbox escape. An attacker would need to lure a user into viewing a crafted page; once the exploit is triggered, arbitrary code can run within the sandbox.