This vulnerability is a use‑after‑free flaw in the V8 JavaScript engine used by Google Chrome versions prior to 147.0.7727.55. The flaw allows an attacker to trigger an arbitrary code execution inside the browser’s sandbox through a specially crafted HTML page. The weakness is identified as CWE‑416 and CWE‑825, reflecting a memory corruption issue that can be exploited to break sandbox isolation and execute code with the privileges of the browser process.

Google Chrome running on Windows, macOS, and Linux is impacted, with all releases preceding version 147.0.7727.55 vulnerable. The flaw is not limited to a specific component of the OS but manifests in the Chrome rendering engine across all supported platforms.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests low current exploitation likelihood. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a remote attacker delivering a malicious HTML page that a user opens in a vulnerable Chrome instance, enabling code execution within the browser sandbox.