A use‑after‑free flaw in the printing subsystem of Google Chrome on Linux allows an attacker who has already compromised the renderer process to escape the browser’s sandbox. This can enable execution of arbitrary code on the host operating system, potentially granting full system control to the adversary. The weakness is a classic use after free, matching CWE‑416, and is flagged as Critical by Chromium’s own severity assessment.

Google Chrome for Linux versions earlier than 149.0.7827.53 are affected. Any machine running those releases on a Linux desktop is vulnerable.

The vulnerability can be exploited by delivering a specially crafted HTML page that causes the renderer to free a memory region and then reference it again. While the current exploit requires compromise of the renderer process, the attack vector is effectively remote through malicious web content. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The CVSS score of 8.3 indicates high severity, so a successful exploit would have significant impact. Without early remediation the risk for an attacker is pronounced, especially in environments where users visit untrusted sites.