The vulnerability is a use‑after‑free in the compositing subsystem of Google Chrome. A crafted HTML page can cause a remote attacker to trigger code execution within the browser’s sandbox. The flaw is classified as a use‑after‑free (CWE‑416) that permits arbitrary code execution, which is a significant integrity compromise.

Affected systems are all installations of Google Chrome with a version older than 155.0.8059.84. The vulnerability is present only in the stable channel before that specific build. No other vendors or products are affected.

The CVSS score of 8.8 indicates high severity. No EPSS data is provided and the vulnerability is not listed in the CISA KEV catalog, so the exploitation likelihood cannot be quantified from the available information. A remote attacker can exploit the flaw by delivering a malicious web page that the user views, which then triggers the use‑after‑free within the compositing engine. Because the code runs inside the sandbox, the attacker can elevate privileges within that sandbox environment but not necessarily escape it.