A use‑after‑free flaw was discovered in the core of Google Chrome on Windows before version 148.0.7778.168. The vulnerability allows an attacker who has already compromised the renderer process to trigger a sandbox escape by delivering a specially crafted HTML page. Based on this, it is inferred that the attacker could execute arbitrary code with elevated privileges, thereby impacting confidentiality, integrity, and availability.

The flaw applies to Google Chrome installations on Windows running any version older than 148.0.7778.168; all users of the affected releases are at risk.

The EPSS score is reported as less than 1%, showing a very low exploitation probability. The CVSS score of 8.3 indicates high severity. The vulnerability is not listed in the CISA KEV catalog. Based on the attack vector described, it is inferred that an attacker would need to serve a malicious page to a compromised renderer, a capability that can be achieved over the network, and that this scenario may have a low likelihood of exploitation due to the requirement of a pre‑existing compromise.