A use‑after‑free vulnerability exists in the input handling component of Google Chrome versions prior to 153.0.8010.36. This flaw permits a remote attacker to execute arbitrary code within the browser sandbox by delivering a specially crafted HTML page. The attack leads to compromise of the sandboxed rendering process, potentially escalating privileges if the sandbox is bypassed or further exploited.

The vulnerability affects Google Chrome; affected versions are those released before 153.0.8010.36. No other vendors or products are listed.

The issue carries a high severity rating from Chrome's security team, with a CVSS score of 8.8. The EPSS score is less than 1%, indicating a low probability of exploitation in the general population, but the potential impact remains high. The flaw is not listed in the CISA KEV catalog, suggesting limited widespread exploitation data at present. However, the nature of the exploit—remote code execution via a crafted HTML payload—implies that an attacker who can persuade a user to visit a malicious web page can achieve code execution within the browser context. The low EPSS score does not mitigate the high severity and reachable attack vector, so it should be treated as a significant risk when the vulnerable Chrome version is in use.