A use‑after‑free defect in Chrome’s prerendering engine can be triggered by a specially crafted HTML document. When a vulnerable Chrome instance processes such a document during prerender, the flaw allows an attacker to execute arbitrary code inside the browser process’s sandbox. This constitutes remote code execution within the sandbox environment, potentially affecting client confidentiality, integrity and availability during the browsing session. The weakness is classified as CWE‑416.

This vulnerability affects Google Chrome browsers earlier than version 155.0.8059.84. The impact is limited to the prerender feature; other components of the browser are not directly involved.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker hosting a malicious web page that is prerendered by the vulnerable Chrome client, allowing code execution inside the sandboxed browser process.