A flaw that frees non‑heap memory in Chrome’s font handling logic (CWE‑590) could let a remote attacker running a crafted HTML page execute code beyond the sandbox. The vulnerability may be abused through social engineering, where a victim is tricked into loading the malicious page, exposing the system to arbitrary code execution. The impact is the loss of all confidentiality, integrity, and availability because code can run with the user’s privileges.

Affected system: Google Chrome, versions up to and including 154.0.8037.56. All users of the Chrome stable channel running these or earlier releases are at risk.

The CVSS score of 9.6 indicates critical severity. The lack of an EPSS score does not imply low risk; the vulnerability can be exploited remotely by a social engineering attack, where a user is tricked into loading a crafted HTML page that triggers the font handling flaw. The execution occurs outside the browser sandbox, granting full system privileges. The vulnerability is not yet listed in CISA KEV, so no known exploits have been observed publicly, but the high severity and exploit path make it a high‑risk issue for all affected Chrome users.