A use‑after‑free flaw occurs in Chrome’s SurfaceCapture component, enabling a remote attacker to supply a specially crafted HTML page that triggers heap corruption. The vulnerability is classified as a high‑severity memory corruption issue (CWE‑416) and also represents an inadequate protection against released data vulnerability (CWE‑825). The description indicates that the attacker may exploit the resulting heap corruption, but specific secondary impacts such as code execution are not explicitly detailed in this advisory.

Google Chrome browsers running any version earlier than 148.0.7778.216 are susceptible. The issue is present on all desktop operating systems where the SurfaceCapture feature is enabled.

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and its EPSS score is less than 1%, indicating limited publicly known exploitation evidence. The CVSS score of 8.8 indicates a high severity. The bug can be triggered remotely simply by visiting a malicious web page. Given its high severity classification, the risk level is elevated for users who encounter untrusted web content, although no publicly documented exploits are known.