Technical impact
Chrome’s Verifier component contains a use‑after‑free flaw that can be triggered by crafted network data sent to a compromised renderer process. Exploitation may allow code to execute outside the browser sandbox, potentially giving an attacker control over the affected system and access to user data. The weakness is classified as CWE‑416 and CWE‑825 and carries a CVSS score of 8.3, indicating a high severity for affected users. Based on the description, the primary impact is arbitrary code execution rather than denial of service or data exfiltration alone.
Affected Systems
The vulnerability exists in all desktop installations of Google Chrome versions earlier than 154.0.8037.57, on Windows, macOS, and Linux. It affects the core browser product not extended applications or plugins. No further version granularity is supplied, so the entire pre‑154 release line is considered at risk.
Risk and Exploitability
The CVSS score signals a serious attack. No EPSS data is available, so the current placement in exploit probability models cannot be assessed, but the lack of a KEV listing implies no known public exploit deployments yet. The attacker must first compromise the renderer process, then send specially crafted traffic to trigger the use‑after‑free. If successful, execution would occur outside the sandbox, giving the attacker a foothold at the host level. Overall, the risk is high if the renderer is compromised and the flaw remains unpatched.
Debian DSA