A use after free vulnerability exists in Google Chrome's FileSystem API in versions prior to 149.0.7827.53. The flaw allows a remote attacker to exploit a crafted HTML page loaded into Chrome, potentially escaping the sandbox that normally isolates web content. Escaping this sandbox can give the attacker the ability to execute arbitrary code with the privileges of the user’s Chrome process. The weakness is classified as CWE‑416.

All installations of Google Chrome running a version older than 149.0.7827.53 on any supported operating system are susceptible, regardless of user‑account privileges.

Chromium labels the issue as high severity, and the vulnerability can be triggered via a victim visiting a malicious HTML page. While the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the high severity rating suggests a strong incentive for attackers to develop or use exploit code once it becomes publicly known. The attack vector is a remote attacker delivering a crafted page; no specific configuration or privileged access is required beyond normal browsing activity.