A use‑after‑free flaw within the Blink rendering engine of Google Chrome versions prior to 147.0.7727.55 allows a remote attacker to execute arbitrary code inside the browser’s sandbox by delivering a malformed HTML document. The vulnerability is a classic Use After Free (CWE‑416) combined with an inconsistent volume handling vector (CWE‑825). If exploited, the attacker can run code with the same identity as the browser process, potentially leading to local privilege escalation or system compromise.

The flaw affects Google Chrome for desktop on Windows, macOS, and Linux platforms. Any installation of Chrome with a version earlier than 147.0.7727.55 is vulnerable, regardless of operating system. Users of older Chrome releases should update to the latest stable channel release to mitigate the risk.

The CVSS score of 8.8 indicates a high severity vulnerability. The low EPSS score of less than 1% suggests that large‑scale exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack requires a malicious HTML page to be opened by the user, implying that phishing or social engineering could be used as the vector. Due to the critical nature of the impact and the potential for remote code execution, organizations should treat the flaw as a high priority.