A use‑after‑free vulnerability was discovered in ANGLE, Chrome's graphics abstraction layer, which allows a remote attacker to execute arbitrary code within the browser's sandbox. The flaw is a classic use‑after‑free scenario (CWE‑416). Based on the description, it is inferred that the flaw can be triggered by a crafted HTML page served by a remote attacker. If successfully exploited, the attacker gains the ability to run code with the privileges of the running Chrome process, potentially compromising system integrity and confidentiality.

Google Chrome on macOS versions prior to 148.0.7778.96 is affected. The issue is limited to the stable channel releases for desktop users who are running Chrome before the 148.0.7778.96 update.

The exploit requires a remote attacker to serve a malicious, specially crafted webpage that the victim visits. Based on the description, it is inferred that the attack vector is a remote attacker delivering a malicious webpage. The EPSS score is 0.00074, which indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The Chromium security team rated the issue as high severity with a CVSS score of 8.8, indicating that if exploited the impact could be significant. No publicly known exploit exists yet, but the remote code execution nature and the lack of mitigation in earlier versions make the risk substantial.