A use‑after‑free flaw in the ANGLE graphics stack of Google Chrome, present in all releases before 148.0.7778.216, allows a remote attacker to execute arbitrary code from within the browser sandbox by loading a specially crafted HTML page. The vulnerability was rated high in Chromium’s internal severity assessment and is classified as a use‑after‑free (CWE‑416) with additional buffer underflow concerns (CWE‑825).

Google Chrome desktop builds distributed through the Stable channel and any earlier channel, for both Windows, macOS, and Linux, that have not yet reached version 148.0.7778.216, are affected. The patch is included in all Chrome revisions equal to or newer than 148.0.7778.216 across all supported operating systems.

The asset exploitation probability, as measured by EPSS, is below 1 % and the vulnerability is not listed in CISA’s KEV catalog. However, the CVSS score of 8.8 indicates a severe risk. The likely attack vector is a malicious or phishing web page that a user visits; the page can include the crafted content that triggers the free‑after‑use and enables code execution inside the sandbox. No public exploits have been documented, but the high score, widespread user exposure, and web‑delivery potential make the threat realistic.