The vulnerability is a classic use‑after‑free flaw located in the Views component of Google Chrome on macOS. When the renderer process, which has already been compromised by an attacker, frees memory but later attempts to access it, the browser can act on invalid data. This behavior can be exploited to break the sandbox and gain arbitrary code execution on the host. The weakness aligns with CWE‑416 and CWE‑825, a memory safety defect that directly threatens the confidentiality and integrity of the system.

Google Chrome for macOS versions earlier than 148.0.7778.216 are affected. The flaw exists specifically in the renderer process of the browser when the operating system is macOS. No other platforms or browser versions are listed.

The defect is rated as high severity by Chromium and has a CVSS score of 9.0. The EPSS score is 0.00035, indicating a very low probability of exploitation. The issue is not listed in CISA’s KEV catalog, so no widespread exploitation has been reported. The likely attack vector is a remote attacker delivering a crafted HTML page to a user running an affected version of Chrome. The attacker must first compromise the renderer process, then trigger the use‑after‑free to escape the sandbox. The impact is full control of the user’s system from within the browser environment.