A use‑after‑free bug in the Bindings implementation of Google Chrome allows a crafted HTML page to trigger a memory error that can be exercised by a remote attacker to execute code inside the browser sandbox. The vulnerability is a memory‑corruption flaw (CWE‑416) that permits arbitrary code to run with sandbox privileges, potentially leading to data exfiltration or further exploitation of the host system if sandbox escape techniques are applied.

The bug affects versions of Google Chrome older than 154.0.8037.57. Users running any Chrome release prior to that build are susceptible. The problem was discovered in the stable channel, and the patch was released in the 154.0.8037.57 update available for Desktop browsers.

The CVSS score of 8.8 indicates high severity, and the vulnerability is considered a remote code‑execution risk. EPSS data is currently unavailable, and the vulnerability is not listed in CISA KEV, implying no known widespread exploitation yet. However, because the flaw can be activated via a simple HTML payload delivered over the network, the attack vector is inferred to be remote and could be used by an attacker with a network presence or a malicious website to compromise a user’s system if the browser is vulnerable.