Chrome browsers prior to version 148.0.7778.216 contain a use‑after‑free flaw in the Input subsystem that can lead to heap corruption when a user engages in specific UI gestures on a crafted HTML page. This weakness, classified as CWE-416 and CWE-825, could allow a remote attacker who convinces a user to interact with such a page to potentially execute arbitrary code on the host. The vulnerability is deemed high severity.

All installations of Google Chrome that are running versions older than 148.0.7778.216 are potentially affected. The flaw is tied to the Input component of the browser and does not involve other products or browsers.

The attack requires the user to open a malicious page and perform particular UI actions, so it is a remote, user‑interaction‑dependent exploit with a CVSS score of 7.5 indicating high severity. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the issue is not listed in CISA’s KEV catalog. Despite the low probability, the high severity rating and the potential for arbitrary code execution justify treating the vulnerability as a significant risk. Prompt application of the vendor‑issued fix is strongly recommended to mitigate this threat.