A use‑after‑free flaw occurs in the Controls component of Google Chrome when rendering a specially crafted HTML page. The vulnerability allows a remote attacker to run arbitrary code within the browser’s sandbox. This weakness is identified as CWE‑416 and can be abused to compromise the integrity of the user’s browsing session, potentially leading to further attacks on the host system.

Any desktop installation of Google Chrome on the Stable channel that is earlier than version 157.0.8103.38 is affected. The issue was identified in the Controls module that handles web page rendering and has no vendor‑specific work‑arounds listed.

The flaw is marked as high severity by Chromium’s security team, reflecting its ability to trigger remote code execution. No EPSS score is currently available, and the vulnerability is not in the CISA KEV catalog. Attackers would need to entice a user to open or load a malicious HTML document that triggers the use‑after‑free, thereby gaining a foothold inside the browser’s sandbox.