A use‑after‑free flaw in the V8 JavaScript engine of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox by loading a specially crafted HTML page. The flaw stems from an improper release of memory followed by its reuse, a classic heap corruption vulnerability identified as CWE‑416. Successful exploitation could let an attacker run code with the privileges granted to the sandboxed renderer, potentially compromising data confidentiality and enabling further actions such as lateral movement or credential theft.

The vulnerability affects Google Chrome installed on desktop platforms with a version older than 155.0.8059.84. All releases in the stable channel prior to the checksumed 155.0.8059.84 build are impacted; the fix is included in Chrome version 155.0.8059.84 and later.

The CVSS base score of 8.8 classifies this flaw as high severity, and the EPSS score of < 1% indicates a low exploitation probability. The vulnerability is not listed in CISA's KEV catalog. The most likely attack vector is a remote attacker hosting a malicious web page; a user who opens the page triggers the use‑after‑free and gains code execution inside the sandbox. No publicly disclosed exploits are documented, but the high severity and ability to run arbitrary code make it a significant concern for any user who visits untrusted web content.