A use‑after‑free flaw in Chromium’s V8 engine lets a remote attacker run arbitrary code while the browser remains inside its sandbox. The vulnerability arises from improper memory handling, as identified by CWE‑416.

Google Chrome versions earlier than 155.0.8059.79, including all platforms that installed the browser through standard distribution channels prior to the October 2026 stable channel update, are affected.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% shows that exploitation is currently unlikely, and the flaw is not listed in the CISA KEV catalog. According to the description, a malicious webpage can trigger the use‑after‑free, granting the attacker code execution confined to the sandbox process.