Chrome’s WebMIDI implementation on Android contains a use‑after‑free bug that can be triggered from a crafted HTML page. The flaw, classified as CWE-416 (Use After Free) and CWE-825 (Memory Leak), allows an attacker who first gains control of the renderer process to escape the renderer sandbox, potentially executing arbitrary code on the device. The high severity score of 8.3 reflects the significant impact on confidentiality, integrity, and availability of the device.

The vulnerability affects Google Chrome for Android versions prior to 148.0.7778.216. Devices running these builds that display web content are at risk when encountering maliciously crafted pages. Any user employing such versions of the browser on Android could be exposed.

The flaw requires a remote attacker to deliver a malicious HTML page that the Chrome renderer can load, first compromising the renderer process, then triggering the use‑after‑free to escape the sandbox. The CVSS score of 8.3 indicates a high risk of unauthorized code execution on the device. The EPSS score is < 1% (0.00032), and the vulnerability is not listed in CISA’s KEV catalog, but the combination of high severity and the requirement of a renderer compromise suggests the attack vector is plausible under the right conditions. Mitigating factors include the need for an initial renderer compromise, which can be addressed by enforcing stricter web content controls or disabling WebMIDI entirely.