The vulnerability is a use-after-free flaw in the Metrics component of Google Chrome, classified as CWE-416 and CWE-825. It allows a remote attacker to craft network traffic that triggers a use-after-free condition, enabling the execution of arbitrary code outside the browser sandbox. The impact results in the compromise of the host system’s confidentiality, integrity, and availability because attacker code can run with elevated privileges if exploitation succeeds.

Google Chrome version 154.0.8037.57 and earlier on all supported operating systems are affected. The flaw can be triggered on any machine running those versions of Chrome that accepts external network traffic potentially crafted to target the vulnerable component.

The CVSS score of 8.1 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation at the time of this analysis. The likely attack vector is a remote attacker sending specially crafted traffic to a victim’s Chrome instance, potentially using the browser’s ability to request network resources, such as HTTPS or HTTP requests, or WebSocket connections. While the precise exploitation conditions are not fully disclosed, the description indicates that arbitrary code execution outside the sandbox is possible.