A use‑after‑free flaw exists in Chrome’s Accessibility module, allowing a remote attacker who has already compromised the renderer process to craft an HTML page that triggers memory corruption (CWE-416) and an authority bypass path (CWE-825). The bug enables attackers to execute code with the privileges of the renderer process and potentially elevate privileges on the host machine.

All desktop installations of Google Chrome prior to version 148.0.7778.168 are affected. The flaw exists in the Accessibility component of the renderer process and therefore impacts all Chrome instances that use that component.

Chromium considers the severity high, reflected in a CVSS score of 7.5. No EPSS data is available and the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to already have control over the renderer, for example via a malicious webpage or injected process. Once that condition is met, the use‑after‑free can be triggered to execute code, leading to a full remote code execution. The lack of public exploitation data suggests a lower likelihood of widespread attack at this time, but the high severity and privilege‑elevation potential warrant prompt remediation.