A use‑after‑free bug in Chrome’s accessibility layer on Windows allows a remote attacker who has already compromised the renderer process to trigger a sandbox escape by serving a crafted HTML page. The vulnerability is rated critical by the Chromium security team.

Google Chrome on Windows, versions older than 147.0.7727.138.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the official security rating is critical. An attacker would need to first compromise the renderer process and then deliver a malicious HTML payload that exploits the use‑after‑free; if successful, the attacker could escape the renderer sandbox and potentially execute code with higher privileges.