A use‑after‑free vulnerability in Mojo within Google Chrome permits a remote attacker who has compromised the renderer process to escape the sandbox, potentially enabling arbitrary code execution. The flaw is classified as CWE‑416 and CWE‑825 and is considered high severity by Chromium security. The vulnerability arises when a crafted HTML page causes the renderer to access freed memory, leading to a sandbox escape.

Google Chrome versions prior to 148.0.7778.168 on all supported operating systems are affected. Users running any earlier Chrome release must update to the fixed version. The issue does not impact only a specific platform but spans all desktop editions where the renderer process can be exploited.

The exploit requires a compromised renderer process, which a remote attacker may obtain through a malicious web page or other content. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the current exploitation probability is uncertain, though the high severity rating indicates a potentially severe impact should exploitation succeed. The CVSS score of 8.3 indicates high severity. The attack vector is remote via crafted HTML, implying that any user browsing malicious content could be at risk if unpatched.