A use‑after‑free bug was discovered in the HID implementation of Google Chrome versions before 154.0.8037.57. The flaw allows a malicious renderer process that has already been compromised to read or modify freed memory, potentially enabling the execution of arbitrary code beyond the sandbox. The weakness, identified as CWE‑416, could lead to full system compromise if an attacker is able to trigger the flaw through a crafted web page.

The vulnerability affects Google Chrome browsers running on desktop platforms, specifically all releases prior to 154.0.8037.57. Users of earlier stable channel builds are at risk unless they have applied the latest security update.

The CVSS base score of 8.3 indicates a high severity and the lack of an available EPSS score means the exploitation probability cannot be precisely quantified, but the vulnerability is technically feasible when a renderer process is already under attacker control. Since the flaw is not listed in the CISA KEV catalog, no public exploit is known to be actively used, yet the capability remains high. The likely attack vector involves a remote web page that the user opens, which then contains specially crafted HTML designed to trigger the use‑after‑free in the renderer. If the attack succeeds, the resulting code execution occurs outside of Chrome’s sandbox, potentially compromising the host system.