A use‑after‑free flaw in Chrome's GPU subsystem allows a remote attacker to execute arbitrary code inside the browser sandbox through a specially crafted HTML page. The vulnerability can be triggered by loading malicious content, enabling the attacker to run code with sandbox privileges, potentially compromising the user’s system or data.

Google Chrome browsers with versions earlier than 148.0.7778.168 are affected. The issue resides in the GPU module and impacts the stable channel, as noted by Google’s security release for that version.

The CVSS score is 8.8, indicating high severity, and the Chromium Medium severity rating corroborates significant risk. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers likely require the victim to open an attacker‑crafted HTML page, possibly delivered via social engineering or a compromised site. Successful exploitation yields remote code execution confined to the sandbox, but an attacker could leverage that foothold to breach sandbox boundaries if additional vulnerabilities exist.