A use‑after‑free flaw in the Core component of Google Chrome on Windows allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the browser sandbox. The vulnerability is a classic memory corruption issue (CWE‑416) and is rated by Chromium as a high‑severity issue.

Google Chrome running on Windows, any version prior to 153.0.8010.36. The patch applied in the 153.0.8010.36 release addresses the memory corruption that could be exploited when a malicious HTML page is rendered by a compromised renderer.

The flaw requires an attacker to achieve foothold in the renderer process, which typically involves delivering a crafted HTML payload to the user. Because the flaw enables execution outside the sandbox, it poses a severe risk to confidentiality, integrity, and availability of the host system. EPSS score of < 1% and CVSS score of 8.3 illustrate that, while exploitation is currently rare, the vulnerability remains high‑severity and the potential for remote code execution makes it a high‑risk issue. The vulnerability is not listed in the CISA KEV catalog, but its high severity and the potential for remote code execution make it a high‑risk vulnerability. Based on the description, the likely attack vector is a malicious web page that leverages the renderer compromise to trigger the use‑after‑free and inject code.