The vulnerability is a use‑after‑free in the V8 JavaScript engine that can be triggered from a crafted HTML page. It allows a malicious page to gain execution privileges within the browser sandbox, potentially leading to compromise of the user’s machine if the sandbox is bypassed. The weakness is a memory corruption flaw that permits arbitrary code execution inside the sandboxed context.

Google Chrome versions prior to 155.0.8059.84 on all platforms are affected. The issue is reported for all variants of the Chrome browser shipped by Google.

The CVSS score of 8.8 indicates high severity. No EPSS score is published, and the vulnerability is not listed in KEV. The likely attack vector is a remote attacker delivering a malicious web page that can be opened in the victim’s browser. Successful exploitation would allow arbitrary code execution under the limited privileges of the browser sandbox, providing potential for privilege escalation if sandbox bypasses are available.