The vulnerability is a use‑after‑free bug in the DOM implementation of Google Chrome. A malicious web page can trigger a memory deallocation error that allows the attacker to execute arbitrary code inside the browser’s sandbox. Because the code runs with sandbox privileges, the attacker can compromise the sandbox environment and potentially elevate privileges, exfiltrate data, or pivot to other parts of the system, depending on other system defenses.

Google Chrome is affected in all releases prior to version 148.0.7778.179. The issue resides in the core DOM engine, so any Chrome installation that has not yet applied the 148.0.7778.179 fix is vulnerable, across Windows, macOS, Linux, Android, and other platforms via the stable channel.

The bug allows a remote attacker to exploit vulnerable Chrome by serving a specially crafted HTML page, which can be hosted under attacker control or delivered through phishing. Exploitation requires the user to load or render the malicious page. Chromium rates the severity as Medium, no EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 8.8, and the need for user interaction and sandbox containment reduces risk, yet arbitrary code execution inside the browser demands a high priority response.