Google Chrome contains a use‑after‑free vulnerability in its password handling component (CWE‑416) that allows a remote attacker to execute arbitrary code by delivering a crafted HTML page to a user. The flaw exists in all Chrome releases prior to 148.0.7778.96 and can be triggered when the page is rendered in the browser, enabling the attacker to run code with the same privileges as the browser process, potentially compromising confidentiality, integrity, and availability of the victim system.

The vulnerability affects Google Chrome versions released before 148.0.7778.96 on all supported platforms, including Windows, macOS, and various Linux distributions. Users who have not upgraded to the patched release remain exposed regardless of operating system.

The CVSS score of 8.8 classifies the flaw as high risk. Attackers can exploit the vulnerability by publishing a malicious web page that the victim opens, which leads to arbitrary code execution. The EPSS table does not list an exploit probability, and the vulnerability is not included in the CISA KEV catalog, but the absence of these marks does not reduce the inherent risk posed by a remote code execution flaw.