Technical impact
Use‑after‑free in the Aura user‑interface layer of Google Chrome allows a remote attacker who has compromised the renderer process to potentially escape the renderer sandbox through a crafted HTML page. The flaw permits the attacker to access memory that should be protected, which can be leveraged to execute arbitrary code on the host system. The weakness is classified as CWE‑416 (Use After Free) and CWE‑825 (Memory Safety).
Affected Systems
All Google Chrome browsers older than version 148.0.7778.96 on any supported platform are affected. The issue is present in every build that predates this patch release.
Risk and Exploitability
The vulnerability carries a CVSS score of 8.3, indicating high severity, and is not currently listed in the CISA KEV catalog. Since the exploit requires prior compromise of the renderer process and a user opening a maliciously crafted page, the attack surface is limited but the potential impact is severe. EPSS score of 0.00063 indicates a very low but non‑zero likelihood of exploitation; however, given the high severity and the nature of the flaw, organizations should treat the risk as significant.
Debian DSA