A use‑after‑free bug in the GPU path of Google Chrome on Windows versions prior to 148.0.7778.179 allows a remote attacker to run arbitrary code inside the browser’s sandbox by delivering a specially crafted HTML page. The flaw is a classic use‑after‑free (CWE‑416) that can escape the sandbox if triggered, potentially giving the attacker full control over the host system, compromising confidentiality, integrity, and availability. The issue also involves an unsafe API misuse (CWE‑825) that exacerbates the risk by allowing improper handling of resources.

Google Chrome running on Windows, any build earlier than 148.0.7778.179, including the 148.0.7778.x series before the 179 release.

An EPSS score of < 1% indicates a very low but nonzero exploitation probability, but Chromium labels the issue as high severity with a CVSS score of 8.8, indicating a strong likelihood of exploitation if a suitable trigger is provided. The vulnerability can be triggered remotely via a malicious web page, which means an active or compromised site can act as a vector. The flaw is not listed in CISA’s KEV catalog, and no public exploit has been documented, but the attack surface remains significant given the wide user base of Chrome.