A use‑after‑free flaw in the CSS engine of Google Chrome allows a remote attacker to execute arbitrary code within the browser’s sandbox. The weakness, classified under CWE‑416, gives attackers the ability to run malicious code in the context of a web page that a user visits. Consequently, user data and system resources can be compromised, and the attacker may gain elevated privileges if the sandbox is bypassed.

Google Chrome versions earlier than 157.0.8103.38 are affected. The vulnerability exists in the stable desktop channel and any installations that have not received the 157.0.8103.38 update or newer are at risk.

The vulnerability is rated high severity and, because the attack vector is a crafted HTML page, a remote user can easily trigger exploitation by delivering a malicious web page to a victim. The EPSS score is not available, so a precise exploitation probability cannot be given, but the lack of a KEV listing does not diminish the technical risk. The immediate impact is remote code execution within the sandbox, allowing an attacker to potentially gain control over the local machine if further exploitation steps succeed.