Use-After-Free in ANGLE can be triggered by a crafted HTML page rendered in the Chrome renderer process. If the renderer process has been compromised, an attacker can potentially bypass the browser sandbox to execute code outside of the protected environment. This flaw is a classic use-after-free (CWE-416) and was rated high severity by Chromium.

The vulnerability affects Google Chrome versions prior to 149.0.7827.53. All users running earlier stable channel releases are potentially exposed until the patch is applied.

The CVSS score of 8.3 indicates high severity, but no EPSS data are available and the advisory is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation would require an attacker to first compromise the renderer process and then deliver a crafted HTML payload, implying a moderate to high complexity. Because a sandbox escape can grant system-level privileges, the risk of remote code execution is significant and mitigations should be applied promptly.