A use‑after‑free flaw in WebPackaging allows an attacker who has compromised the renderer process to trigger crafted HTML that causes an out‑of‑band read or execution outside Chrome’s sandbox. The attacker can potentially run arbitrary code with the user’s privileges, effectively breaking the browser’s isolation model. Chromium rates this flaw as high severity.

Google Chrome versions earlier than 153.0.8010.36 are affected. The vulnerability exists in all builds that use the older WebPackaging implementation, while Chrome 153.0.8010.36 and later contain the fix. The affected product is the desktop Chrome browser provided by Google.

The CVSS score is 8.3, indicating a high severity vulnerability, while the EPSS score of less than 1% suggests a very low expectation of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a prior compromise of the renderer process, after which a crafted page can trigger the use‑after‑free and escape the sandbox. Given the high impact but low probability, organizations should still patch immediately to prevent potential remote code execution.