A use‑after‑free bug in the Canvas API of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to execute arbitrary code inside the browser sandbox through a specially crafted HTML page. The flaw is triggered when freed memory is accessed, enabling code injection that can compromise the confidentiality, integrity, or availability of the user’s data and potentially break out of the sandboxed environment. The vulnerability’s severity is high, as an attacker can deliver malicious content that runs with the same privileges as the browser process.

The affected product is Google Chrome (stable channel) on all platforms that ship a version earlier than 157.0.8103.38. No other vendors or products were listed as affected.

The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, but the official Chrome advisories rate the issue as high. The attack vector is inferred to be through a crafted HTML page served over the Internet, which can be displayed in the user’s browser. Exploitation requires the user to open the malicious page or inject the payload into a site the user visits; it does not appear to need local privilege escalation beyond the sandboxed browser process. Given the lack of mitigating publish‑time information, the risk remains significant for any user running an unpatched Chrome build.