A use‑after‑free bug in the network component of Google Chrome allows a remote attacker to execute arbitrary code by delivering a specially crafted HTML page. This issue is rated critical in Chromium’s internal severity scale, indicating that successful exploitation can lead to full system compromise, including data theft or further lateral movement.

The vulnerability affects all installations of Google Chrome up to, but not including, version 149.0.7827.53. Any machine running one of these versions on supported operating systems and browsing the web is potentially exposed.

Because the flaw is triggered by malicious web content, the attack vector is likely a URL or embedded resource delivered through a browser session. The CVSS score of 8.8 confirms a high level of severity, though no EPSS score is available, so the likelihood assessment relies on the absence of public exploit evidence. The vulnerability is not listed in the CISA KEV catalog; however, the custom severity and the nature of the flaw suggest that entities with high exposure should treat this risk as imminent.