A use‑after‑free bug in the codecs component of Google Chrome allows a malicious web page to use memory that has already been freed, enabling an attacker to run arbitrary code inside the browser’s sandbox. The flaw is confined to the codec processing path and is triggered when the browser renders a specially crafted HTML document. The likely attack vector is a malicious web page delivered to a user, inferred from the described scenario of a crafted HTML page.

All desktop deployments of Google Chrome older than version 147.0.7727.101 are affected. This includes installations on Windows, macOS, and Linux that have not yet applied the stable‑channel update released in April 2026.

The vulnerability carries a CVSS score of 8.8, reflecting high severity, and an EPSS score of less than 1%, indicating a low but non‑zero exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit it by delivering a malicious webpage to a user who opens it in the vulnerable browser, causing code to execute with sandbox privileges, which may be leveraged to expand the attack surface if additional weaknesses exist.