A use‑after‑free flaw in Chrome’s Digital Credentials API, classified as CWE-416 and CWE-825, can trigger memory corruption that may result in a sandbox escape, potentially allowing an attacker to execute arbitrary code with elevated privileges within the browser process.

The vulnerability affects Google Chrome installations older than version 146.0.7680.153 on all major platforms, including Windows, macOS, and Linux, because the Digital Credentials API is present across these operating systems.

The CVSS base score of 8.8 indicates high severity, and the EPSS assessment shows a low likelihood of exploitation (<1%). This vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploits yet. Based on the description, the likely attack vector involves a malicious web page that is rendered by a process that has already been compromised in its renderer, implying the need for user interaction through a specialized crafted HTML page. This inference is drawn from the statement that a remote attacker who has compromised the renderer process can potentially perform a sandbox escape via a crafted HTML page.