The vulnerability is a use‑after‑free in the Chrome compositor that can let a malicious web page run code after the renderer has been freed, permitting a sandbox escape. The flaw can let the attacker run arbitrary code outside the renderer sandbox, potentially affecting the entire operating system. It is classified as a high‑severity weakness (CWE‑416).

Google Chrome versions earlier than 146.0.7680.178 are affected. This includes any installation of Chrome on Windows, macOS, or Linux platforms where the compromised renderer process could be accessed via a crafted HTML page.

The CVSS score is 9.6, indicating a very high impact if successfully exploited. The EPSS score is below 1%, suggesting that exploitation in the wild is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: a user visiting a malicious web page can trigger the flaw once the renderer process is compromised. Due to the need for renderer compromise, the practical risk is moderate unless the system is already vulnerable to other compromise vectors.