A use‑after‑free flaw in the Ozone component of Google Chrome could enable an attacker to run arbitrary code when a user opens a specially crafted HTML page. The weakness is identified as CWE‑416 and CWE‑825, indicating a use‑after‑free followed by a memory corruption condition that can be exploited to run arbitrary code. This flaw has a Chromium security severity of Critical, implying that exploitation could result in complete loss of confidentiality, integrity, and availability on the affected device.

Google Chrome versions before 149.0.7827.53 on desktop systems are affected. The issue originates from the Ozone rendering engine, so all platforms that run this code path are at risk until the patch is applied.

The vulnerability can be triggered remotely by delivering a malicious HTML page to the user; the attack vector is inferred to be via a web page or downloaded content. The EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation. The flaw is not listed in the CISA KEV catalog, so real‑world exploitation potential remains uncertain. However, the critical severity and availability of an effective fix in the latest releases strongly suggest that the risk is high for unpatched installations.