A use‑after‑free flaw in Chrome’s Modularization component permits a remote attacker to execute arbitrary code inside the sandbox when a specially crafted HTML page is loaded. The vulnerability was rated as high severity by Chromium’s internal assessment, indicating that exploits could lead to significant compromise of the sandboxed environment.

Google Chrome browsers older than version 157.0.8103.38 are affected. Users running any build before that release are at risk until the update is applied.

The CVSS score and EPSS data are not available; only Chromium’s internal rating of high severity is provided. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring the victim to open a malicious HTML document or visit a page containing the crafted payload. Because the code runs inside the Chrome sandbox, an attacker could potentially elevate privileges within the sandbox and, with additional steps, could escape to the host system.