A use‑after‑free vulnerability exists in Blink, the rendering engine of Google Chrome. The flaw allows an attacker to craft a malicious HTML page that, when rendered, triggers a memory error. This defect enables the attacker to execute arbitrary code inside Chrome’s sandbox, potentially compromising the user’s system or data. The weakness is identified as CWE‑416.

The problem affects Google Chrome versions prior to 147.0.7727.55 on all platforms where the Blink engine is used. Users running any unsupported or older releases are exposed.

Chromium rates the vulnerability as High. ESPS score is not available, and the issue has not been added to CISA’s KEV catalog. Based on the description, the likely attack vector is a remote user delivering a crafted HTML page to a victim’s browser. An exploit requires only that the user visit the malicious page; no additional configuration or privileges are needed. Consequently, the risk is elevated for any environment that relies on an outdated Chrome installation.