The vulnerability is a use‑after‑free in the Skia graphics framework used by Chrome. The flaw, classified as CWE‑416, occurs when memory that has been freed is accessed again, allowing a remote attacker who has compromised the renderer process to potentially trigger unwanted code execution. According to the description, this can enable a sandbox escape via a crafted HTML page.

Google Chrome desktop versions older than 148.0.7778.96 are affected on all platforms—Windows, macOS, and Linux—when compiled with the vulnerable Skia library. Users running those builds without the update are vulnerable if a malicious page can be rendered by Chrome.

The EPSS score is not available, but the CVSS score of 8.3 and the Chromium‑assigned high severity, together with the flaw’s ability to escape the renderer sandbox, indicate substantial risk. The description indicates that the vulnerability requires a remote attacker who has already compromised the renderer process to deliver a crafted HTML page that triggers the use‑after‑free. Once triggered, the sandbox can be bypassed, potentially allowing the attacker to escape the renderer sandbox. The Chromium high severity assessment indicates that patching should be treated as urgent.