Use‑after‑free vulnerability was found in the Chrome renderer before version 148.0.7778.96. A remote attacker who could compromise the renderer process may craft a malicious HTML page that triggers the misuse of freed memory and causes arbitrary code execution inside the sandboxed environment.

All installations of Google Chrome with a version older than 148.0.7778.96 are vulnerable. The patch is included in the stable‑channel update released on May 2026 and applies to all desktop platforms.

The CVSS score is 8.8. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack requires prior compromise of the renderer, but once achieved it can execute code inside the sandbox, potentially leading to data exposure or privilege escalation within the browser context.