A use‑after‑free flaw in the DigitalCredentials component of Google Chrome allows a remote attacker who has already compromised the renderer process to construct a specially crafted HTML page that may trigger a sandbox escape. This vulnerability is a classic example of CWE‑416, with the potential to break out of the restrictive renderer sandbox, thereby risking arbitrary code execution and full system compromise. The flaw grants the attacker elevated privileges beyond the confined browser context, leading to privilege escalation and data exfiltration.

Google Chrome browsers prior to version 149.0.7827.155 are vulnerable. The issue is confined to the renderer process in Chrome on desktop platforms. No other vendors or product lines were reported to be affected.

The CVSS score of 8.3 indicates high severity. The EPSS score of <1% suggests that active exploitation of this flaw is currently unlikely, though the possibility remains. This vulnerability is not listed in CISA's KEV catalog. Based on the description, the attack vector is inferred to be a crafted HTML page accessed by an attacker who first breaches the renderer process. Without the renderer compromise, the flaw is not exploitable. The combination of remote code execution potential and a low exploitation probability results in a moderate overall risk to affected users.