Technical impact
A use‑after‑free flaw (CWE-416) in the Views component of Google Chrome allows a remote attacker to potentially run arbitrary code outside the browser sandbox through a specially crafted HTML page. The vulnerability can be exploited when a maliciously crafted page is loaded, leading to the execution of attacker‑controlled code in a privileged context and thereby undermining confidentiality, integrity, and availability of the affected system.
Affected Systems
Google Chrome versions prior to 154.0.8037.57 are affected. The issue applies to the stable channel of the browser and impacts all platforms that run the vulnerable build.
Risk and Exploitability
The CVSS score of 9.6 classifies this as a critical vulnerability, and the lack of an available EPSS score precludes a precise exploitation probability estimation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves serving or loading a crafted HTML page from an attacker’s server, which triggers the use‑after‑free in a view object and allows execution outside the sandbox.
Debian DSA