Use‑after‑free in the Aura user‑interface layer of Google Chrome allows a remote attacker who has compromised the renderer process to potentially escape the renderer sandbox through a crafted HTML page. The flaw permits the attacker to access memory that should be protected, which can be leveraged to execute arbitrary code on the host system. The weakness is classified as CWE‑416 (Use After Free).

All Google Chrome browsers older than version 148.0.7778.96 on any supported platform are affected. The issue is present in every build that predates this patch release.

The vulnerability carries a CVSS score of 8.3, indicating high severity, and is not currently listed in the CISA KEV catalog. Since the exploit requires prior compromise of the renderer process and a user opening a maliciously crafted page, the attack surface is limited but the potential impact is severe. EPSS data is unavailable, so the precise likelihood is uncertain; however, given the high severity and the nature of the flaw, organizations should treat the risk as significant.