The vulnerability is a use‑after‑free Google Chrome page. When the flaw is exploited, memory corruption can cause the browser to execute arbitrary code outside its sandbox. This bypass of Chrome’s security boundary enables a remote attacker to run code with the privileges of the user’s process, potentially compromising the entire system. The issue falls under CWE‑416, reflecting improper handling of freed memory that can lead to unauthorized execution. The remote exploitation path relies on having the user visit a malicious web page, after which the vulnerable code path is triggered. The impact is significant: an attacker can gain full control of the victim’s machine from a remote web page, undermining confidentiality, integrity, and availability of the affected system.

Google Chrome versions prior to 153.0.8010.47, across Windows, macOS, and Linux platforms.

The CVSS base score of 8.8 indicates high severity, and the EPSS score is below 1%, implying a low but non‑zero exploit probability at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote user who visits a crafted HTML page hosted on a malicious or compromised website. Once the page loads, the use‑after‑free can be triggered, allowing code execution outside the browser sandbox.