A use‑after‑free bug within the FedCM component of Google Chrome allows an attacker to execute arbitrary code confined to the browser’s sandbox. The flaw can be triggered through a specially crafted web page, leading to unauthorized code execution inside the sandboxed environment. No information in the CVE statement indicates that the attacker can escape beyond the sandbox to system‑level privileges; the impact is limited to the sandbox boundaries.

The vulnerability affects any installation of Google Chrome with a build number earlier than 146.0.7680.165. The CVE description does not specify supported operating systems, but since Google Chrome runs on Windows, macOS, and Linux, users of those platforms using affected versions are potentially exposed.

The CVSS score of 8.8 classifies this flaw as high risk. The EPSS value of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a malicious web page that the victim visits, which triggers the use‑after‑free during a FedCM operation. The flaw requires only user interaction and a vulnerable browser version to be exploited.