A use‑after‑free flaw in Ozone, the graphics stack in Google Chrome on Linux, can corrupt heap memory when an attacker crafts a specific HTML page and convinces a user to perform particular UI gestures. If the heap corruption succeeds, the attacker may obtain arbitrary code execution with the privileges of the Chrome process. The flaw is a critical security issue, classified as a use‑after‑free (CWE‑416).

Google Chrome for Linux versions earlier than 149.0.7827.53 are affected. The vulnerability does not affect other operating systems.

No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. However, the CVSS score of 7.5 indicates a high risk if an attacker can convince a user to load a malicious page. The attack vector requires client‑side execution: the victim must view a crafted web page and perform a specific set of user interface gestures. With the described conditions, successful exploitation would allow an attacker to gain execution privileges on the user’s machine.