A use‑after‑free flaw exists in the WebAuthentication component of Google Chrome, where a remote attacker can trigger heap corruption by delivering a specially crafted HTML page that the user must view and interact with through specific UI gestures. The CVE description notes only the potential exploitation of heap corruption, and does not state that code execution or other specific consequences are guaranteed.

Google Chrome versions prior to 149.0.7827.53 on all supported operating systems are affected. The issue was reported for the stable channel and applies to desktop installations that have this build or older.

The CVSS base score of 7.5 indicates a high risk level, but no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploitation in the wild. The likely attack vector involves a social‑engineering scenario where an attacker lures a user to a malicious web page that presents specific UI gestures, such as button clicks or scrolling, to trigger the vulnerability. Although proof of exploitation has not been documented, the possibility of heap corruption warrants prompt attention.