A use‑after‑free bug in ANGLE, present in Google Chrome before version 148.0.7778.216, allows a remote attacker who has already compromised the renderer process to craft a malicious HTML page that triggers the flaw. The vulnerability is a CWE‑416 and CWE‑825 condition and can lead to a sandbox escape, giving the attacker the capacity to execute arbitrary code with elevated privileges within the renderer context, potentially compromising confidentiality, integrity, and availability.

Google Chrome browsers that are older than version 148.0.7778.216 are affected. The vulnerability is limited to the ANGLE graphics component used by Chrome for rendering.

The CVE has a CVSS score of 8.3, indicating high severity. EPSS score of 0.00035 (less than 1%) indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to first compromise the renderer process, typically by luring a user onto a malicious website that serves the crafted HTML. Once the exploitation path is executed, the attacker can escape the sandbox and potentially gain full code‑execution rights on the host.