The vulnerability is a use‑after‑free in the GPU code path of Chrome before 148.0.7778.96 that can allow a remote attacker, once the renderer process is compromised, to escape its sandbox via a maliciously crafted HTML page. The flaw originates from improper memory handling in the graphics pipeline, identified as a memory safety issue CWE‑416. If exploited, the attacker could elevate privileges within the render process, potentially leading to execution of arbitrary code on the host. Based on the description, it is inferred that this privilege escalation can compromise the host operating system.

Affects any Chrome desktop build older than 148.0.7778.96, regardless of operating system, because the GPU component is common across platforms. Users running legacy versions must verify and update to a fixed release.

The risk is significant; with a CVSS score of 8.3, the vulnerability is considered high severity. Attack requires a compromised renderer process, which can arise from malicious web pages or compromised extensions. The exploit would need to trigger the use‑after‑free through a crafted page, making a malicious website or drive‑by attack a likely vector. The likely attack vector is a malicious website that supplies a crafted HTML page to trigger the use‑after‑free. While publicly known exploits are not yet available, the potential impact warrants immediate action.