The vulnerability is a classic use‑after‑free flaw (CWE‑416) in the Ozone component of Google Chrome. An attacker can craft a malicious HTML page that, when a user engages with specific UI gestures, triggers the weakened object to be freed and then accessed again, resulting in heap corruption. If an attacker succeeds, the corrupted heap can be exploited to execute arbitrary code within the browser’s process, effectively allowing remote code execution.

The flaw exists in Google Chrome versions prior to 145.0.7632.45. Because Chrome runs on Windows, macOS, and Linux, all supported operating systems that host the affected Chrome builds are impacted. Users of any of these platforms should verify that their Chrome installation is at or above the specified version.

The CVSS score for this issue is 8.8, indicating high severity. However, the EPSS score is reported as less than 1%, suggesting that, at present, the probability of exploitation in the wild is low. The flaw is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to lure a user to a specially crafted web page and perform certain UI gestures; it does not demand privileged system access or special network conditions.