This vulnerability is a use‑after‑free condition (CWE‑416) in Google Chrome’s Network component on Windows, and it also includes an unchecked buffer copy (CWE‑825) during network initialization. An attacker who has already compromised a renderer process can trigger the flaw by delivering a specially crafted HTML page, potentially leading to a sandbox escape. Once outside the renderer’s restricted environment, the attacker may execute arbitrary code with browser process privileges, compromising system confidentiality and integrity.

Google Chrome for Windows is affected on all releases prior to version 148.0.7778.168. Users running any earlier Windows build must update to 148.0.7778.168 or later to mitigate the issue.

Chromium classifies the severity as High with a CVSS score of 8.3; no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating that exploitation is not widely reported. The attack vector requires an attacker to have a foothold in the renderer process, commonly through malicious web content or a local compromise, and to serve the crafted HTML that triggers the use‑after‑free. Until the patch is applied, the risk of unauthorized code execution on a victim’s Windows system remains significant.