Google Chrome contains a use‑after‑free flaw in its network stack that can corrupt heap memory when a specially crafted HTML page is parsed. The vulnerability is classified as a use‑after‑free (CWE‑416) and leads to heap corruption (CWE‑825). The description states that a remote attacker could potentially exploit this corruption, implying that arbitrary code execution is a possible outcome if an exploit is crafted, which would allow compromise of the browser and potentially the underlying host system. This potential impact is inferred from the description and has not been confirmed as a fully mature exploit.

All versions of Google Chrome older than 146.0.7680.153 on Windows, macOS, and Linux are affected. Any user running an earlier Chrome release on any of these operating systems is susceptible.

The vulnerability has a CVSS base score of 8.8, indicating high severity. The EPSS score is reported as less than 1 %, suggesting that exploitation is currently unlikely. It is not listed in the CISA KEV catalog. The likely attack vector is remote via a crafted HTML page; a user must visit a malicious or compromised website to trigger the heap corruption. Both the likelihood of exploitation and the severity imply a significant risk if an attacker succeeds.