Technical impact
The vulnerability is a use‑after‑free in the graphics pipeline of Chrome prior to version 148.0.7778.96, which can be triggered by a crafted HTML page. This flaw arises from improper memory handling in the GPU component and is identified by CWE‑416 and CWE‑825. If an attacker can compromise the renderer process through the web content, the defect may allow the process to escape its sandbox, potentially leading to execution of arbitrary code on the host system.
Affected Systems
All desktop builds of Chrome older than 148.0.7778.96 on any operating system are affected because the GPU code is shared across platforms. Users must verify and apply the most recent Chrome release or an equivalent security update.
Risk and Exploitability
The CVSS score of 8.3 indicates a high severity impact if exploited. However, the EPSS score of less than 1% suggests that current exploitation probability is low, likely due to the need for a renderer process compromise that is not yet widespread. The CVE is not listed in the CISA KEV catalog, meaning no publicly known exploits have been documented yet. Based on the description, the likely attack vector is a malicious website or compromised extension that delivers a crafted page, which would trigger the use‑after‑free. The threat therefore remains significant but with a modest current exploitation likelihood.
Debian DSA