A use‑after‑free flaw in Google Chrome’s DOM handling allows a remote attacker to run arbitrary code inside the browser’s sandbox through a specially crafted HTML page. The vulnerability is a classic example of CWE‑416, where exposed memory is accessed after it has been freed. Exploitation can lead to execution of malicious scripts or binaries within the constrained sandbox environment, potentially compromising user data, bypassing security controls, or facilitating further lateral movement across the host system.

All users of Google Chrome versions earlier than 148.0.7778.96 are affected. The flaw is present in the Chrome stable channel for desktop browsers. No specific sub‑model or patch level beyond the version designation is listed.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, but the vulnerability is classified as high severity by Chromium. Since it is not listed in CISA’s KEV catalog yet, no known exploits have been documented publicly. However, the attack vector is remote, relying on a malicious web page that can be delivered via HTTP or HTTPS, and the sandbox restriction can be bypassed by a specialized exploit chain. The impact is significant enough to warrant immediate attention from all affected users.