A use‑after‑free vulnerability exists in the WTF parser used by Google Chrome. When a specially crafted HTML page is processed, the application can free an object before it finishes using it, allowing an attacker to execute arbitrary code inside the browser’s sandbox. The flaw is a classic memory corruption issue that can lead to code execution, compromising confidentiality and integrity of data handled by the browser.

The vulnerability affects all installations of Google Chrome before version 157.0.8103.38. Any user running a browser older than this build and exposed to a malicious web page is at risk.

Because the error occurs during HTML parsing, a remote attacker only requires delivering a crafted page to a user’s browser; no additional credentials or elevated permissions are needed. The EPSS score is not available and the issue is not listed in KEV, but the Chromium security team has categorized the flaw as Medium severity. Even without an official CVSS score, the possibility of arbitrary code execution inside the sandbox indicates a high impact, so the risk remains significant until the patch is applied.