Technical impact
Google Chrome contains a use‑after‑free flaw in the Views component that allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox through a crafted HTML page. The vulnerability enables execution of malicious code with the privileges of the affected process, potentially allowing an attacker to compromise the entire system. The weakness is identified as CWE‑416 and carries a high severity rating.
Affected Systems
All users running Google Chrome versions older than 154.0.8037.57 are affected. The issue is limited to the desktop stable channel and does not affect other products or earlier stable releases that already incorporate the fix.
Risk and Exploitability
The CVSS score of 8.3 indicates a high impact. Though an EPSS score is not available, the vulnerability requires a compromised renderer process and a crafted HTML payload, making exploitation moderately difficult but still likely in environments where renderer isolation is weak. The flaw is not listed in the CISA KEV catalog, but its high severity and potential for remote code execution warrant immediate attention.
Debian DSA