A use‑after‑free flaw exists in the Animation subsystem of Google Chrome versions prior to 147.0.7727.138. When a crafted HTML page is rendered, the browser can execute arbitrary code inside its sandboxed process, bypassing isolation safeguards. This is a high‑severity vulnerability defined by CWE‑416, which can lead to remote code execution when the attacker controls page content.

The flaw affects all desktop installations of Google Chrome that use the legacy snapshot of the Animation module, specifically any release before 147.0.7727.138. The vulnerability is scoped to the rendering engine in Chrome’s stable channel and applies uniformly across supported operating systems that run the affected Chrome binary.

The CVSS score is 8.8, indicating a high severity for this misuse. The vulnerability allows a remote attacker to trigger exploit by loading a crafted HTML page, resulting in code execution inside Chrome’s sandbox. Although the attack requires interacting with the page, the high CVSS score and lack of a KEV listing suggest that exploitation remains possible if patching is delayed. The EPSS score is < 1%.