Technical impact
The vulnerability is a use‑after‑free in the Skia graphics framework used by Chrome. The flaw, classified as CWE‑416 and CWE‑825, occurs when memory that has been freed is accessed again, allowing a remote attacker who has compromised the renderer process to potentially trigger unwanted code execution. According to the description, this can enable a sandbox escape via a crafted HTML page.
Affected Systems
Google Chrome desktop versions older than 148.0.7778.96 are affected on all platforms—Windows, macOS, and Linux—when compiled with the vulnerable Skia library. Users running those builds without the update are vulnerable if a malicious page can be rendered by Chrome.
Risk and Exploitability
The EPSS score is < 1%, indicating that the exploitation probability is very low, but the CVSS score of 8.3 and the high severity assigned by Chromium, combined with the flaw’s ability to escape the renderer sandbox, still point to a significant risk. The description indicates that the vulnerability requires a remote attacker who has already compromised the renderer process to deliver a crafted HTML page that triggers the use‑after‑free. Once triggered, the sandbox can be bypassed, potentially allowing the attacker to escape the renderer sandbox. The Chromium high severity assessment indicates that patching should be treated as urgent.
Debian DSA