A use‑after‑free flaw, identified as CWE-416, exists in the Core component of Google Chrome on Windows prior to version 148.0.7778.216. The flaw is triggered by a specially crafted HTML page; combined with insufficient privilege checks (CWE-825), it can enable a remote attacker who has already compromised the renderer process to escape Chrome's sandbox. The official Chromium severity classification is High, but the CVE does not indicate unrestricted code execution, only a potential sandbox escape that could allow further compromise of the underlying operating system.

All Windows users running Google Chrome with a version earlier than 148.0.7778.216 are affected. The vulnerability targets the renderer process component and requires that Windows be the operating system.

The CVSS score is 8.3, and the EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, using a malicious website to deliver the crafted HTML page to a user whose renderer process is already compromised. Because the flaw requires prior renderer compromise to succeed, the overall risk is elevated for users interacting with malicious content but the window for exploitation is limited by both the need for the initial renderer compromise and the low probability indicated by EPSS.