The vulnerability is a use‑after‑free bug in Chrome DevTools that allows a malicious web page to trigger the reuse of freed memory. By opening a crafted HTML page in the browser, an attacker could inject arbitrary code that runs with the privileges of the DevTools sandbox. This flaw is classified as CWE‑416 and CWE‑825 and is rated as high severity. The impact is the execution of code that could potentially escape the sandbox and compromise the host system, depending on additional weaknesses.

This issue affects Google Chrome versions prior to 154.0.8037.57. Users running older Chromium‑based browsers are vulnerable when DevTools is available and can be opened by an attacker’s web page. The affected component is the DevTools architecture within the browser.

The CVSS score of 8.8 indicates that the vulnerability is severe and requires user interaction to exploit. The EPSS score is currently not available, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is a web‑page sent to the user that, when opened in Chrome, opens DevTools or triggers its internal logic, leading to exploitation. Although the attack requires user action, the high severity and potential for arbitrary code execution make it a significant risk to any system with the affected Chrome version.