A flaw in the GPU resource handling of Google Chrome allowed a renderer process that had already been compromised to use a released resource incorrectly, potentially enabling arbitrary code execution outside the browser sandbox. The weakness is identified as CWE-672, a flaw that allows an attacker to misuse a released resource.

The vulnerability applies to releases of Google Chrome prior to version 157.0.8103.38. Any user running these older builds is at risk, provided an attacker can compromise the renderer process via a crafted HTML page.

No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires an attacker to first compromise the renderer process, it is likely limited to browsers that have previously been exploited or exposed to malicious content. Nevertheless, the impact—remote arbitrary code execution—makes it a high‑risk vulnerability once the initial renderer compromise is achieved.