A use‑after‑free flaw in Chrome’s DevTools permits a remote attacker who has already compromised the renderer process to craft a malicious HTML page that can trigger a sandbox escape. This vulnerability enables the attacker to break out of the renderer sandbox and potentially execute arbitrary code with host system privileges. The flaw is classified as high severity with a CVSS score of 9.6 and is identified as CWE‑416.

Google Chrome versions earlier than 147.0.7727.117 are affected. The flaw applies to all platforms where Chrome is installed, including Windows, macOS, Linux, and mobile devices running Android. Any system running a vulnerable Chrome build is susceptible if an attacker can supply a crafted HTML page to the user’s browser.

The vulnerability carries a CVSS score of 9.6, indicating a high exploitation risk, while the EPSS score is below 1 %, suggesting a relatively low current exploitation probability. The flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, relying on a crafted HTML page that a user may view in Chrome. Once the attacker delivers the malicious content and compromises the renderer, the use‑after‑free can be leveraged to escape the sandbox. Successful exploitation would grant the attacker significant privileges, potentially enabling full system compromise.