Chrome’s JavaScript engine, V8, contains a use‑after‑free flaw that permits a remote attacker to run arbitrary code inside a sandboxed environment by delivering a specifically crafted HTML page. The vulnerability is a classic memory corruption issue, classified as CWE‑416, and is considered high severity by Chromium security reviewers.

This flaw affects Google Chrome releases prior to version 147.0.7727.55. Users running any earlier stable build are potentially vulnerable.

The exploit requires only that a malicious web page be loaded in the affected browser, making the attack vector inbound, client‑side. While the EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog, the reported high severity and the remote code execution capability indicate a significant risk for any user who visits compromised sites. No specific privileged escalation is required; the code runs within the browser’s sandbox. The lack of a public exploit in the wild does not diminish the threat posed to users who do not promptly apply the available patch.