Technical impact
Chromium’s Platform module contains a use‑after‑free bug that can be triggered by a specially crafted HTML page. The flaw causes the browser to access memory that has already been freed, allowing an attacker to execute arbitrary code inside the sandboxed renderer process. The vulnerability originates from improper deallocation of resources and incorrect handling of memory after it has been freed, which is reflected in CWE‑416 and CWE‑825. Because the code runs within the browser’s sandbox, the compromise is limited to the browser context, but still permits execution of malware‑like actions.
Affected Systems
Any installation of Google Chrome older than version 154.0.8037.57 that is capable of rendering the malicious page is vulnerable. Chrome is distributed for Windows, macOS and Linux. The likely affected platforms are therefore Windows, macOS and Linux, though the vulnerabilities exist for any OS that runs the described Chrome version.
Risk and Exploitability
The CVSS score of 8.8 indicates high severity. EPSS data is unavailable, so the exploitation probability is unknown; the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring delivery of a malicious HTML page to the victim’s browser. Once triggered, the code runs with sandbox privileges; no escalation beyond the sandbox is documented in the available data.
Debian DSA