A use‑after‑free bug in the CSS engine of Google Chrome before version 147.0.7727.101 lets a remote attacker trigger arbitrary code execution within the sandbox by serving a specially crafted HTML page. The weakness stems from improper handling of freed memory during style parsing, associated with CWE‑416. The flaw is also classified as CWE‑825, reflecting inadequate reinitialization of data structures after freeing, which contributed to the vulnerability. If exploited, it could allow an attacker to execute code inside the browser’s sandbox, potentially leading to further system compromise if sandbox escape techniques are employed.

Google Chrome browsers running versions earlier than 147.0.7727.101 are affected. This includes all desktop installations of Chrome that have not been updated to the latest stable release. No other vendors or products are listed as impacted.

The vulnerability carries a high Chromium security severity, but no EPSS score is available, indicating uncertainty about current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack can be carried out by hosting a malicious web page that contains crafted CSS; an unsuspecting user rendering the page can trigger the use‑after‑free. The condition requires that the victim’s browser loads the malicious page, so the attack vector is likely a web‑page‑based, social‑engineering or drive‑by scenario.