A use‑after‑free bug in Chrome’s WebGPU implementation allows a crafted web page to run arbitrary code inside the browser’s sandbox. The flaw occurs when the GPU buffer is freed while still referenced, enabling an attacker to manipulate memory and trigger execution. This can lead to the execution of malicious code, which may be used for data exfiltration, credential theft, or further exploitation within the user’s session.

The vulnerability affects Google Chrome versions earlier than 146.0.7680.165 on all major operating systems that run the browser, including Windows, macOS, and Linux. The affected component is the WebGPU feature inside the Chromium engine.

The flaw carries a CVSS score of 8.8, classifying it as high severity, but the EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting low current exploitation prevalence. Attackers would need to entice a user to open a malicious webpage that leverages WebGPU, making the threat primarily a user‑initiated, remote execution scenario. Despite the low exploitation likelihood, the potential impact warrants immediate attention.