A use‑after‑free flaw in the core of Chrome on Windows allows a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox. The vulnerability can be triggered by a specially crafted HTML page and, if successful, grants the attacker the ability to execute code with privileges that exceed those of the sandboxed renderer. The flaw is identified as CWE‑416 and CWE‑825, highlighting risks associated with memory reuse after free and unsafe memory handling.

Google Chrome running on Windows machines with a version older than 148.0.7778.216 are affected. The flaw exists in the rendering engine and applies to all installations of Chrome that have not yet been updated to the patched release.

The flaw carries a CVSS score of 8.3, and its EPSS score indicates a very low but non-zero exploitation probability; it is not yet listed in the CISA KEV catalog. The likely attack vector is a remote attacker delivering malicious HTML that reaches a compromised renderer; once exploited, sandbox escape can lead to full system compromise. The weakness is identified as CWE‑416 and CWE‑825, corresponding to memory reuse after free and unsafe memory handling, respectively.