A use‑after‑free flaw in the Scheduling component of Google Chrome enables a remote attacker to execute arbitrary code inside the browser sandbox via a specially crafted HTML page. The weakness (CWE‑416) allows malicious code to run with the browser process’s privileges, potentially leading to data exposure, credential theft, or further system compromise. According to the Chromium security severity assessment, this vulnerability is considered medium. 

All desktop installations of Google Chrome versions prior to 157.0.8103.38 are affected. The issue applies broadly to Windows, macOS, and Linux builds of the stable channel. Users running earlier builds should consider the risk until the build is updated. 

No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTML page accessed by the user—such as via a malicious website or email attachment—exploit­ing the Scheduling code path to trigger the use‑after‑free. Given the medium severity rating and the availability of a patch, the risk is moderate but should be addressed promptly.