This flaw is a use‑after‑free bug in the Document Object Model handling of Google Chrome. A remote attacker who delivers a specially crafted web page can trigger the bug and get the renderer to execute arbitrary code, although the execution occurs within the browser sandbox. The weakness corresponds to CWE‑416, which is a classic instance of memory corruption that permits arbitrary code execution. The flaw also corresponds to CWE‑825, indicating improper release of resources.

All installations of Google Chrome running versions older than 148.0.7778.216 are potentially vulnerable. The defect exists in the stable channel releases prior to that build and affects all platforms that ship the same renderer code.

Because the vulnerability can be triggered by any HTML file served over the network, an attacker who can influence HTTP responses to a user can exploit it without further interaction. The CVSS assessment classifies it as High severity with a CVSS score of 8.8, and no exploitation probability estimate is available from EPSS data, while it is not listed in CISA’s KEV catalog. The impact is to allow code execution inside the browser sandbox, which could facilitate privilege escalation or bypass of content‑security restrictions.