This vulnerability is a use‑after‑free flaw in the Media component of Google Chrome. A specially crafted HTML page can trigger the defect, allowing a remote attacker to execute arbitrary code inside the browser’s sandbox process. The result is that the attacker can run code within the limited sandboxed environment, which may be leveraged for privilege escalation or to compromise additional system resources if escape mechanisms are available. The weakness is classified as CWE‑416.

Google Chrome versions older than 155.0.8059.79 are affected. All builds of the standard Chrome browser in the stable channel prior to that revision are vulnerable.

The CVSS score of 8.8 indicates a high severity level. The EPSS probability is reported as less than 1%, signifying a low likelihood of exploitation in the wild at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a remote web page that can be served to the user's browser, meaning that simply visiting a malicious site could trigger the flaw and deliver code into the sandbox. Given the high CVSS and the potential for arbitrary code execution, it is advisable to mitigate promptly.