The vulnerability is a use‑after‑free flaw in the Glic component of Google Chrome, classified as CWE‑416 and CWE‑825. It allows a remote attacker to craft an HTML page that, when opened in the browser, triggers the use‑after‑free and causes the browser to execute arbitrary code while operating inside its sandbox.

The flaw affects all editions of Google Chrome running any version older than 148.0.7778.216. This includes the stable channel, beta, dev, and canary builds that have not yet received the 148.0.7778.216 update. Users on Windows, macOS, and Linux platforms are susceptible, as the vulnerability is in the core Chromium rendering engine shared across platforms.

Chromium has labeled the severity as High. The CVSS base score is 8.8, indicating high severity. The EPSS score is 0.0008, showing a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a remote attacker delivering a crafted HTML page to a user’s browser, suggesting that the flaw is exploitable when users access malicious or compromised web content. Because sandboxing limits the damage, the impact is mitigated compared to an arbitrary‑code execution that escapes sandbox boundaries, yet the ability to run code inside the browser remains a serious threat.