A use‑after‑free flaw in the navigation handling of Google Chrome allows a malicious HTML page to exploit a renderer process that has already been compromised. The vulnerability can be leveraged to escape the browser’s sandbox, giving an attacker the ability to execute code outside the normal sandboxed environment. The weakness is a classic use‑after‑free bug (CWE‑416), and the Chromium tracker rates the severity as medium, but the CVSS score of 8.3 indicates a high‑impact vulnerability that threatens the confidentiality, integrity, and availability of the user’s system.

Google Chrome versions prior to build 148.0.7778.96 are affected. The vulnerability targets the Chrome browser on all platforms that run these builds.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests it is not widely exploited in the wild at this time. However, the attack requires a remote attacker to serve a crafted HTML page and to have already gained control of the renderer process. If achieved, the sandbox escape could lead to arbitrary code execution on the host system. Given the high severity rating of CVSS 8.3 and the potentially high impact of a sandbox escape, the vulnerability warrants prompt remediation.