This vulnerability is a use‑after‑free bug in the WindowDialog component of Google Chrome. When a renderer process is compromised, a crafted HTML page can trigger the bug, allowing the attacker to escape the renderer sandbox and potentially execute code outside the browser sandbox. The weakness is identified as CWE‑416, a flaw that can lead to arbitrary code execution if not properly mitigated.

Affected product is Google Chrome on all major operating systems. Any Chrome installation version earlier than 146.0.7680.71 is vulnerable. The CPE list includes macOS, Linux, and Windows, indicating the issue spans all supported platforms.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% points to a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have already compromised the renderer process; a crafted HTML page can then trigger a use‑after‑free within WindowDialog, allowing the attacker to escape the renderer sandbox and potentially execute code outside the browser environment. For organizations that enforce strict sandboxing and content filtering, the risk may be mitigated, but the potential for remote code execution still warrants prompt attention.