Use after free in the Fullscreen API of Google Chrome prior to 148.0.7778.96 lets a remote attacker potentially escape the browser sandbox by loading a specially crafted HTML page. The flaw arises from improper deallocation of memory that is still referenced, a classic instance of CWE-416. The primary impact is the loss of isolation provided by the sandbox, potentially allowing the attacker to execute code with higher privileges within the host system.

Google Chrome, versions prior to 148.0.7778.96. Users on any platform running an older Chrome build are exposed; the vulnerability is triggered by rendering an HTML page that requests fullscreen operation.

The issue carries a high severity rating per Chromium and a CVSS score of 9.6 indicating a critical level of impact. While EPSS data is not available, the lack of a KEV listing suggests it has not yet been widely exploited. A remote attacker can exploit it by hosting or embedding a malicious HTML page that users open, which triggers the Fullscreen operation. Successful exploitation would break the sandbox boundary, leading to possible code execution or privilege escalation on the host machine.