A use‑after‑free flaw exists in Chrome’s rendering engine that allows a malicious actor to run arbitrary code within the browser’s sandbox. The vulnerability arises when a crafted HTML page is loaded, causing a freed memory region to be accessed and enabling the attacker to inject code that the GPU or other components may execute. Because the attack is confined to the browser sandbox, the impact is limited to the user’s session and any privileged processes that the sandbox may interact with.

The flaw affects Google Chrome on desktop platforms prior to version 157.0.8103.38. Users running any earlier release are susceptible if they encounter a malicious web page containing the crafted payload.

The reported CVE does not yet have an EPSS score, and it is not listed in the CISA KEV catalog. The Chromium security team rates the issue as medium severity. The attack vector is inferred to be an externally crafted HTML page that a remote attacker can serve to a victim. An attacker must be able to load the page in the victim’s Chrome browser; no additional network access or local privileges are required. Given the lack of public exploit data, the exploitation probability is considered moderate, but the potential to run arbitrary code remains high for users not applying the updated release.