The vulnerability is a use‑after‑free in GPU code that can allow a remote attacker who has already compromised the renderer process to escape the sandbox by loading a specially crafted HTML page. Leveraging a freed object access, an attacker may hijack control flow and execute arbitrary code outside the renderer sandbox. Based on the description, this could potentially enable arbitrary code execution beyond the sandbox boundaries, which could lead to broader system compromise.

Google Chrome is affected, specifically any releases prior to version 148.0.7778.216. The issue applies to desktop builds of the stable channel and may impact all users running those versions where GPU acceleration is enabled.

Chromium classifies the severity as High with a CVSS score of 8.3, and the EPSS score is below 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a remote attacker delivering a malicious webpage to a user’s browser; the attacker must, however, already have compromised the renderer process to benefit from the use‑after‑free. Given the lack of public exploitation data, the risk remains theoretical but significant enough to warrant immediate attention.