Use after free in the DOM enables an attacker to craft a malicious HTML page that runs arbitrary code inside the Chrome sandbox, potentially allowing code execution with the same privileges as the browser process. The vulnerability is a memory safety error, corresponding to CWE‑416, and can lead to full system compromise if other sandbox protections are bypassed.

Google Chrome, versions earlier than 157.0.8103.38, on all supported platforms. The flaw resides in the rendering engine used to parse HTML content.

The CVE carries a high severity rating. Exploitation requires only a specially crafted web page, making the attack vector remote and easy to trigger. No EPSS data is available, but because a web page can be served from any site, the risk remains high until the browser is updated to a patched release. The vulnerability is not yet listed in CISA’s KEV catalog.