Google Chrome contains a use‑after‑free vulnerability in the Aura UI framework. A local attacker who can interact with the Chrome UI may trigger the freed object to be reused, allowing execution of arbitrary code beyond the browser sandbox. This flaw is a classic memory corruption flaw (CWE‑416) that can compromise the confidentiality, integrity, and availability of the affected system if an attacker has local access.

The flaw is present in Google Chrome versions prior to 154.0.8037.57 on desktop platforms. Users running any earlier build are susceptible to exploitation.

The CVSS base score is 7.8, indicating high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; an attacker only needs to be able to invoke UI interaction, such as clicking on a link or button, in a Chrome window. Given that no public exploit is yet known and the exploit requires local presence, the immediate risk is moderate but could be high if the attacker gains local access to a user account.