The vulnerability is a use‑after‑free within the Prerender engine of Google Chrome. An attacker can trigger the flaw with a specially crafted HTML page and gain the ability to run arbitrary code inside the browser’s sandbox. The flaw is classified as CWE‑416 and, because it can be triggered remotely, the potential impact is the compromise of the client’s confidentiality, integrity, and availability during an affected browsing session.

Affected vendor: Google’s Chrome browser. Versions earlier than 155.0.8059.84 are vulnerable. The issue is limited to the prerender component; other browser features are not directly impacted.

This exploit has a CVSS score of 8.8 and is identified as critical by Chromium. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an attacker to host a malicious site that delivers a crafted document to an end user, exploiting the prerender path. Because it runs inside the sandbox, execution is constrained but still allows arbitrary code execution within the browser process, which can be leveraged for further lateral movement or credential theft.