A use‑after‑free flaw in the WebGL implementation of Google Chrome allows a maliciously crafted HTML page to trigger a memory corruption event. The bug, classified as CWE‑416 and CWE‑825, enables the attacker to execute arbitrary code within the browser’s sandboxed environment. Once inside the sandbox, the attacker may exploit privileged extensions or bypass access controls, effectively compromising the compromised client system.

Google Chrome browsers on all supported platforms (Windows, macOS, Linux) older than version 146.0.7680.178 are vulnerable. The attack can be launched from any web page loaded in the affected browser.

The vulnerability has a CVSS score of 8.8 and an EPSS probability of less than 1 %. It is not listed in the CISA KEV catalog, indicating that no publicly known exploits are currently available. The attack vector is remote, with an attacker delivering a malicious HTML document to the victim’s browser. If exploited, the attacker gains code execution capability without needing to escape the browser sandbox.