A use‑after‑free flaw in the Fullscreen handling of Google Chrome for Windows allows an attacker who has already compromised the renderer process to escape the browser sandbox. The vulnerability is a classic CWE‑416 scenario that can give the attacker full control of the host system, effectively turning the compromised browser into a privilege escalation vector. The impact is therefore a high‑severity remote code execution.

Google Chrome versions for Windows earlier than 148.0.7778.96 are affected. The flaw lies within the fullscreen feature and is present across all builds of the Chrome stable channel before the specified update.

The issue is rated high severity by Chromium’s security team, though the EPSS score is not yet available. The CVSS score is 8.3. It is not listed in the CISA KEV catalog at present. Because exploitation requires the attacker to first gain control of the renderer process and then deliver a specially crafted HTML page that triggers the use‑after‑free, the attack is plausible but may demand a sophisticated delivery chain. Nevertheless, the potential for complete system compromise warrants a proactive response.