Technical impact
A use‑after‑free flaw in Google Chrome’s DOM handling allows a remote attacker to run arbitrary code inside the browser’s sandbox through a specially crafted HTML page. The vulnerability is a classic example of CWE‑416 and CWE‑825, where exposed memory is accessed after it has been freed and the exploit may involve inappropriate size validation leading to buffer overwrite. Exploitation can lead to execution of malicious scripts or binaries within the constrained sandbox environment, potentially compromising user data, bypassing security controls, or facilitating further lateral movement across the host system.
Affected Systems
All users of Google Chrome versions earlier than 148.0.7778.96 are affected. The flaw is present in the Chrome stable channel for desktop browsers. No specific sub‑model or patch level beyond the version designation is listed.
Risk and Exploitability
The CVSS score of 8.8 indicates high severity. The EPSS score is < 1%, indicating a very low probability of exploitation, but the vulnerability is classified as high severity by Chromium. Since it is not listed in CISA’s KEV catalog yet, no known exploits have been documented publicly. However, the attack vector is remote, relying on a malicious web page that can be delivered via HTTP or HTTPS, and the sandbox restriction can be bypassed by a specialized exploit chain. The impact is significant enough to warrant immediate attention from all affected users.
Debian DSA