A use‑after‑free flaw in the Ozone component of Google Chrome could enable an attacker to run arbitrary code when a user opens a specially crafted HTML page. The weakness is identified as CWE‑416, meaning the program is accessed after the memory it references has been freed. This flaw has a Chromium security severity of Critical, implying that exploitation could result in complete loss of confidentiality, integrity, and availability on the affected device.

Google Chrome versions before 149.0.7827.53 on desktop systems are affected. The issue originates from the Ozone rendering engine, so all platforms that run this code path are at risk until the patch is applied.

The vulnerability can be triggered remotely by delivering a malicious HTML page to the user; the attack vector is inferred to be via a web page or downloaded content. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, so the enumeration of real‑world exploitation potential is uncertain. However, the critical severity and availability of an effective fix in the latest releases strongly suggest that the risk is high for unpatched installations.