A use‑after‑free bug (CWE‑416) and an associated resource management issue (CWE‑825) in the Skia graphics engine of Google Chrome can trigger heap corruption when rendering a specially crafted HTML page. The CVE notes that this can potentially lead to arbitrary code execution or a denial of service; the possibility of RCE or DoS is inferred from that wording, as the description does not confirm a guaranteed exploit result.

Google Chrome desktop installations with versions earlier than 148.0.7778.216 are affected; installing later stable releases mitigates the flaw.

The CVE indicates that any user who opens a crafted HTML page in Google Chrome could trigger the heap corruption, implying a remote attack vector. Although the EPSS score is not available, the absence of exploitation probability data and the lack of KEV listing suggest no known widespread exploits yet. The CVSS score of 8.8 indicates high severity. The combination of remote reach and the possible consequences of RCE or DoS indicates a high‑risk posture that warrants prompt mitigation.