The vulnerability is a use‑after‑free error located in the Base component of Google Chrome, versions prior to 148.0.7778.216. An attacker can deliver a specially crafted HTML page to a user’s browser and cause the use‑after‑free condition to trigger, giving the attacker the ability to execute arbitrary code with the privileges of the local user. This failure is classified as CWE‑416 and CWE‑825 and is considered a critical security flaw in Chromium’s terminology.

Affected systems include all installations of Google Chrome that are not updated to at least version 148.0.7778.216. The problem exists on all supported platforms (Windows, macOS, Linux) as the Base component is cross‑platform. The issue occurs when a browser process parses an HTML file that contains code designed to exploit the memory bug; any user who opens the malicious page is at risk.

The CVSS score is 8.8, but the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog, so there is no publicly disclosed exploit known to be in use. Nevertheless, the attack path is straightforward: a remote attacker hosts a malicious page and lures a victim into visiting it. Because the flaw allows arbitrary code execution, the impact is severe. The risk remains high until browsers are updated.