A use after free bug in Chrome's CSS engine permits a remote attacker to load a specially crafted HTML file that triggers a memory corruption in the sandboxed browsing context. The flaw originates from an uninitialized pointer that is freed and later accessed by the rendering engine. Exploiting this vulnerability allows the attacker to execute arbitrary code inside the browser sandbox, which could then be used to bypass sandbox constraints and gain higher privileges or access sensitive data. The issue is classified as High severity within Chromium's internal risk assessment.

The flaw affects all major builds of Google Chrome that precede update 146.0.7680.178. The vulnerability is platform independent and is present on Windows, macOS, and Linux installations, as indicated by the included CPE identifiers. Any user running a vulnerable version of Chrome is potentially exposed.

The CVSS score of 6.3 indicates a moderate level of severity, and the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently low. The vulnerability is not yet listed in the CISA KEV catalog, and no public proof‑of‑concept exploits have been reported. However, because the flaw requires a user to open a crafted web page, it is exploitable in drive‑by scenarios or through phishing links, making the risk significant for users who frequently visit untrusted sites.