A use‑after‑free flaw in Chrome’s navigation code lets a crafted web page free an object and subsequently reuse it, causing arbitrary code to run inside the browser’s sandbox. The weakness directly supports execution of attacker‑supplied instructions and is classified as CWE‑416. This single vulnerability can compromise the confidentiality and integrity of the user’s system by allowing any code the browser is permitted to run.

Google Chrome versions earlier than 147.0.7727.55 are affected. All platforms that run Chrome before this build—including Windows, macOS, Linux, and Chrome‑based browsers on those operating systems—may be vulnerable to the flaw when visiting a malicious page.

The flaw is exploitable remotely via a crafted HTML page that a user can open or visit over the internet. No special privileges are required beyond normal browser usage, and the attack occurs within the sandbox environment. The vulnerability carries a medium severity rating and is not listed in the CISA KEV catalog; its EPSS score is currently unavailable. The attack vector is inferred from the description of a remote attacker serving a malicious page to the browser.