A use‑after‑free flaw exists in the handling of stored passwords in Google Chrome versions prior to 157.0.8103.38. The vulnerability arises when a malicious actor serves a crafted HTML page to a user, causing the browser to free a memory object and then access it again. This memory reuse can allow the attacker to execute arbitrary code outside of Chrome’s sandbox, compromising confidentiality, integrity, and availability of the user’s system.

Affected systems are all Chrome installations running versions older than 157.0.8103.38. The flaw is present in the desktop Chrome product for all supported operating systems, including Windows, macOS, and Linux. Users who have not applied the latest stable channel update are at risk.

The vulnerability carries a High rating in Chromium’s severity scale, and while a public CVSS score is not provided, the potential for code execution indicates a serious impact. EPSS data is not available, and the issue has not yet been listed in the CISA KEV catalog, suggesting that, as of now, there is no confirmed exploitation of this flaw in the wild. The arbitrary code execution path requires a crafted HTML page, so the attack vector is likely a targeted phishing or malicious website scenario.