The flaw is a use‑after‑free vulnerability in the ANGLE graphics library integrated into Google Chrome. It permits a remote attacker to craft a malicious HTML page that can trigger the freed memory reuse, leading to execution of arbitrary code outside the browser sandbox. This foreign execution can compromise the host system and represents a high‑threat Remote Code Execution vector.

The flaw exists in the ANGLE graphics engine that is part of Google Chrome. It impacts all desktop releases of Chrome older than version 154.0.8037.57. The vendor advisory does not explicitly detail the range of operating systems, so deployments running desktop Chrome on any platform should assume the vulnerability exists until patched.

The severity is reflected in a CVSS base score of 9.6, indicating critical impact. The EPSS score is 0.00462, indicating a low probability of exploitation, and the vulnerability is not listed in CISA KEV. Attackers would need to entice a user to visit a crafted web page; once executed, code runs with the user’s privileges, bypassing sandbox protections. Given the high impact score and lack of official mitigation beyond an update, the vulnerability is considered highly exploitable in environments that are not promptly updated.