A use‑after‑free defect in Chrome’s HID subsystem allows a remote attacker who can persuade a user to perform specific UI gestures on a malicious webpage to trigger a potential sandbox escape. This memory safety flaw is classified as CWE‑416 and CWE‑825 and, if triggered, could give the attacker code execution outside the browser sandbox.

Google Chrome browsers that run before version 148.0.7778.168 are affected. The vulnerability exists in the HID handling code of the browser and is present on all platforms that support the affected builds.

The exploit has a CVSS score of 8.3, indicating high severity, but the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the user to open a crafted page and perform a gesture, which limits the attack surface to users interacting with malicious content. The lack of a published exploit suggests the risk of exploitation is moderate until a public exploit becomes available.