Technical impact
The vulnerability is a use‑after‑free in the Actor component of Google Chrome. An attacker can supply a malicious HTML page that exploits freed memory to run arbitrary code inside the sandboxed renderer process. The flaw is a classic memory‑corruption bug (CWE‑416). Because the code runs with sandbox privileges, the impact is remote code execution, and the potential for privilege escalation exists if the sandbox constraints fail. The CVE lists the Chromium security severity as Medium, but the CVSS score of 8.8 indicates a high risk level.
Affected Systems
Google Chrome versions earlier than 154.0.8037.57 on all supported platforms are affected. The update that includes the fix is published as a stable channel release, so it is reasonable to infer that the vulnerability was present in the stable channel before the update. Users who have not applied the 154.0.8037.57 update remain at risk, regardless of whether updates were applied automatically or manually.
Risk and Exploitability
The CVSS score of 8.8 reflects high severity, with the exploit requiring delivery of a crafted HTML page over the network, which can be attained by visiting a malicious site or hosting a phishing page; no authentication is needed. The EPSS score is not available, so the current probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the high impact and the remote attack vector mean that exploitation could occur in the wild, so the flaw should be treated as urgent.
Debian DSA