A use‑after‑free flaw in the WebAppInstalls component of Google Chrome on Android allows a local attacker to trigger arbitrary code execution by supplying a crafted malicious file. The vulnerability is classified as CWE‑416 and CWE‑825, and was deemed high severity by Chromium security reviewers. The flaw can be exploited only when the attacker controls a malicious file that is processed by the browser, giving the attacker full code execution privileges on the device.

Google Chrome operating on Android devices running versions earlier than 149.0.7827.53 is affected. This includes all builds of Chrome on Android that have not yet been updated to the patched release. No other vendors or product lines are listed as vulnerable.

The vulnerability has no publicly available exploit information and its EPSS score is below 1%, indicating that exploitation is currently unproven. Its CVSS score of 8.8 marks it as high severity. However, the flaw is local and provides full code execution, which can lead to data theft, credential compromise, or device takeover when an attacker can supply the malicious file. The lack of a KEV listing suggests no widespread exploitation yet, but the high inherent risk and local nature warrant prompt mitigation.