Google Chrome contains a use‑after‑free flaw in the DOM that lets an attacker run arbitrary code inside the sandbox when a crafted HTML page is loaded. The vulnerability is a classic memory‑corruption error (CWE‑416) that can compromise confidentiality, integrity, and availability of the affected system by granting the attacker the privileges of the sandboxed process. The impact is that arbitrary code execution within the sandbox environment is possible.

All users running Google Chrome versions older than 153.0.8010.47 are vulnerable. The issue exists in the stable channel and applies to the standard desktop build of Chrome affected.

The CVSS score of 8.8 indicates high severity, but the EPSS score of less than 1% suggests that exploitation is currently unlikely is not listed in the CISA KEV catalog. The attacker must supply a malicious HTML page that a user opens; no external network or attack vector is browser‑based. Because the code runs inside the sandbox, the scope is limited to the sandboxed process.