A use‑after‑free vulnerability exists in the CSS parser of Google Chrome prior to version 145.0.7632.75. The flaw occurs when the browser releases memory that is later accessed while parsing CSS, allowing an attacker to execute arbitrary code in the sandboxed browser process. The execution is confined to the sandbox; launching attacks beyond the sandbox requires additional weaknesses.

Google Chrome installations running any version earlier than 145.0.7632.75 on Windows, macOS, or Linux are affected. Users who load malicious web pages rendered by those browsers are at risk.

The CVSS score of 8.8 categorizes the vulnerability as high severity, and the EPSS score of less than 1 % suggests a low overall exploitation probability, although the vulnerability is listed in the CISA KEV catalog, confirming that active exploitation has been observed. The attack vector is remote, requiring the victim to visit a crafted web page that triggers the parser. Because code runs inside the sandbox, it does not immediately compromise the host system, but it can potentially pivot to other system resources if additional vulnerabilities exist.