A use‑after‑free flaw in the Views component of Google Chrome on Windows allows a remote attacker who has already compromised the renderer process to escape the browser sandbox and execute code beyond the intended isolation boundary. This vulnerability is a typical use‑after‑free error, and its exploitation can lead to arbitrary code execution with the privileges of the user running the browser.

Google Chrome for Windows versions earlier than 147.0.7727.138 are affected. The issue specifically impacts the renderer process in those Chrome builds.

The recorded CVSS score is 9.8, signifying critical severity. The vulnerability is classified as Critical by Chromium. The attack requires that the attacker already have code execution in the renderer process on Windows. Once the use‑after‑free condition is triggered, the browser’s sandbox can be bypassed, allowing execution of code outside the renderer process. The EPSS score is 0.035%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating that there are no publicly reported exploits for it at the time of this analysis.