Use after free in the Blink rendering engine of Google Chrome prior to build 148.0.7778.168 allows a remote attacker to execute arbitrary code inside a sandboxed process by loading a specially crafted HTML page. The flaw arises from incorrectly freeing memory while it is still in use, enabling the attacker to inject and run code that runs with sandboxed privileges.

All users with Google Chrome installed on desktop platforms running any build before 148.0.7778.168 are vulnerable. The issue is confined to the Blink rendering engine in Chrome and does not affect other browsers or prior Chrome releases.

The vulnerability is rated Critical by Chromium and carries a CVSS score of 8.8. It can be triggered remotely by delivering malicious web content that is viewed in the vulnerable Chrome instance. An EPSS score of < 1% is reported, indicating a very low but non‑zero exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalog, indicating that public exploits are not yet known. Nevertheless, the high severity, lack of mitigations in older builds, and potential for arbitrary code execution inside the sandbox make it a high‑risk vulnerability for all exposed users.