The vulnerability is a use‑after‑free flaw in the Autofill component of Google Chrome that enables a remote attacker to trigger execution of arbitrary code outside the browser sandbox. The flaw arises when a crafted HTML page releases memory that is still referenced, causing the browser to operate on invalid data. The primary consequence is that the attacker could potentially run code with elevated privileges, compromising the confidentiality and integrity of the system.

Google Chrome versions prior to 157.0.8103.38 are affected. The flaw is present in the stable channel releases of Chrome available to end‑users on all supported platforms. Any user running those versions is at risk if they visit a malicious web page that triggers the exploit.

Chromium lists the severity as Medium and no EPSS score is currently available. The attack requires social engineering to lure a user to a crafted web page, so exploitation depends on user interaction and the presence of a malicious site. The flaw is not listed in the CISA KEV catalog, suggesting it has not been publicly exploited at scale as of today. Nevertheless, because it can lead to sandbox escape, the risk to affected users remains significant.