The vulnerability is a use‑after‑free within the TabStrip component of Google Chrome, allowing a maliciously crafted web page to trigger UI gestures that corrupt the browser’s heap memory. Depending on the data overwritten, an attacker could tamper with or read sensitive information and potentially execute arbitrary code. This flaw is related to CWE‑416 and CWE‑825, identifying weaknesses in memory management and potential resource handling, respectively.

Google Chrome desktop versions earlier than 148.0.7778.216 contain the vulnerable TabStrip code. The official fix was included in the stable channel update that began with version 148.0.7778.216; any subsequent Chrome release incorporates the patch.

The flaw requires a user’s interaction with a specialized URL that prompts specific UI gestures – a scenario most likely arising from a phishing or social‑engineering attack. The CVSS score of 8.8 highlights a high severity, and although the EPSS score is 0.00035 and the issue is not catalogued in the CISA KEV list, the awareness of this use‑after‑free combined with the need for a targeted user action makes this vulnerability a high impact risk for organizations relying on up‑to‑date browser security.