The vulnerability is a use‑after‑free condition in the FileSystem component of Google Chrome before build 149.0.7827.53. It allows a malicious HTML page to reference freed memory, potentially enabling a sandbox escape and execution of arbitrary code. The weakness is classified as CWE‑416. The consequence is that a remote attacker could gain code execution on the client machine, compromising confidentiality, integrity, and availability.

All users running Google Chrome on any platform with a version older than 149.0.7827.53 are affected. The update 149.0.7827.53 removes the exploitable path. No other Chrome channel or product version is currently affected according to the CNA data.

The CVSS score is 9.6, but Chromium classifies the issue as Critical. The EPSS score is unavailable, and the vulnerability has not been listed in CISA's KEV catalog. The likely attack vector is a crafted HTML page delivered over the network that exploits the use‑after‑free. Without an update, the risk of exploitation remains high for exposed workstations that load untrusted web content.