The vulnerability is a use‑after‑free flaw in Chrome’s Network component that can be triggered from a crafted HTML page. It allows a remote attacker who has already compromised the renderer process to cause a sandbox escape, potentially executing arbitrary code with the privileges of the browser or the host. This vulnerability involves a high‑severity memory‑safety weakness (CWE‑416) and a related data‑flow issue (CWE‑825).

Google Chrome versions before 149.0.7827.53 on desktop platforms are affected; the bug exists in the Network component of the renderer process.

The EPSS score is available and is less than 1%, and the vulnerability is not listed in KEV, yet its high severity and the ability to escape the sandbox mean a successful exploit could lead to full system compromise. The CVSS score is 8.3. An attacker must first breach the renderer process, a non‑trivial requirement, but the impact once achieved is severe.