Use-After-Free error in the Fullscreen feature of Google Chrome allows a remote attacker to craft a malicious HTML page that triggers a memory access after the object has been freed. If the vulnerability is successfully exploited, the attacker can execute arbitrary code outside the normal sandbox protecting the browser, potentially gaining full control of the victim’s system. The flaw is a classic use‑after‑free, identified as CWE‑416.

Google Chrome versions preceding 154.0.8037.57 are affected. The issue applies to all operating systems and builds of the Chrome stable channel that use the earlier code until the security update is applied.

The vulnerability carries a CVSS score of 9.6, indicating a very high severity. No EPSS score is publicly available, and the flaw is not yet listed in the CISA KEV catalog, but the combination of remote trigger and sandbox escape indicates a high risk for attackers. The likely attack vector is a remote attacker delivering a crafted HTML page that the victim opens locally or visits in the browser, exploiting the issue without requiring elevated privileges.