A use‑after‑free flaw exists in the Blink rendering engine of Google Chrome prior to version 148.0.7778.96. When a victim opens a specially crafted HTML page, an out‑of‑bounds read/write can occur, allowing an attacker to run arbitrary code that initially executes inside the Chrome sandbox. The flaw is a classic memory‑corruption vulnerability (CWE‑416) that can lead to remote code execution with sandboxed privileges.

Google Chrome browsers older than 148.0.7778.96 that run on Windows, macOS, and Linux desktop operating systems are affected. The vulnerability is present in all builds of Chrome shipped before the 148.0.7778.96 update, regardless of the device or architecture, but only these desktop platforms are listed in the available CPE data.

The attack can be triggered by loading a malicious web page; no special privileges are required from the victim. EPSS is not available, and the flaw is not listed in the CISA KEV catalog. However, the CVSS score of 8.8 indicates a high risk of remote code execution. An attacker that succeeds could potentially escape the sandbox, enabling lateral movement or privilege escalation within the host system if other local weaknesses exist.