A use‑after‑free flaw in ANGLE, the graphics engine used by Google Chrome, can be triggered by a crafted HTML page when an attacker has already compromised the renderer process. The resulting sandbox escape elevates the attacker’s privileges and allows them to execute arbitrary code on the host machine. The weakness is identified as CWE‑416 and is also associated with CWE‑825.

Google Chrome browsers earlier than version 148.0.7778.216 are vulnerable. The flaw was present in the stable channel and has been addressed in subsequent releases.

The CVE is rated as high severity by Chromium, and its EPSS score is 0.00035, which is below 1%, and it is not listed in the CISA KEV catalog. The likely attack vector involves a malicious HTML document that is rendered by a renderer process that has already been compromised; this requires the attacker to have some foothold in the renderer but does not require privileges on the host. Because the flaw permits sandbox escape, the risk to confidentiality, integrity, and availability is substantial if the vulnerability is exploited. Updating Chrome mitigates the issue, but until a patch is applied, systems remain at high risk.