A use‑after‑free flaw in the QUIC implementation of Google Chrome allows a remote attacker to trigger arbitrary code execution inside the browser sandbox via malicious network traffic. This vulnerability is classified as high severity by Chromium’s security team and can compromise the execution environment of the user’s browser.

Google Chrome versions older than 148.0.7778.179 are affected. The issue is tied to the QUIC protocol stack in these older releases.

Exploitation requires an attacker to send specially crafted QUIC traffic to a user’s Chrome instance. The EPSS score of <1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 8.8 indicates high severity, suggesting that if exploited, the attacker could achieve code execution confined to the browser’s sandbox, potentially escalating to system compromise if additional vulnerabilities are present.