A use‑after‑free vulnerability in the ANGLE graphics layer of Google Chrome on Windows allows a remote attacker to execute arbitrary code within the browser sandbox. The flaw is triggered by a specially crafted HTML page that causes a freed GPU resource to be accessed again, granting the attacker code‑execution privileges with the privileges of the Chrome process. The impact is high, giving an attacker the ability to run arbitrary code on the victim’s system from a malicious web page.

Google Chrome installations on Windows that are older than version 149.0.7827.53 are affected. The flaw exists in the ANGLE component used by Chrome on Windows only, and does not impact other operating systems or non‑Chromium browsers.

The CVSS base score of 8.8 indicates a high severity vulnerability. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, which suggests no documented exploitation in the wild so far. The likely attack vector is a remote, crafted HTML page served over HTTP/HTTPS; the attacker needs the victim to visit the malicious page to trigger the flaw. While exploitation requires a specific payload, the high CVSS score and absence of mitigating controls in affected builds represent a realistic risk to users who have not applied the latest patch.