Use-After-Free in the Viz rendering subsystem of Google Chrome prior to 147.0.7727.101 enables a remote attacker who has already compromised the browser’s renderer process to potentially escape the sandbox. The flaw allows malicious crafted HTML to be processed after the memory that holds rendering data has been freed, providing a foothold for arbitrary code execution outside the renderer’s restricted environment. This flaw corresponds to a use‑after‑free (CWE‑416) and also poses a potential privilege escalation problem (CWE‑825).

All installations of Google Chrome prior to 147.0.7727.101 are affected. The vulnerability was addressed in the stable channel update released in April 2026. Users on these older versions should upgrade to the patched build as soon as it is available.

The CVSS score is 8.3 and the EPSS score is < 1%. The Chromium security team classified the issue as High severity. Exploitation requires the attacker to inject a crafted HTML page and already have a foothold in the renderer process; thus, the attack vector is local to a compromised renderer. Once exploited, the attacker could execute code with elevated privileges on the host system, bypassing the Chrome sandbox. No exploitation proof‑of‑concept has been reported, and the vulnerability is not listed in the CISA KEV catalog.