The vulnerability is a use‑after‑free in the core component of Google Chrome on Android, affecting versions prior to 149.0.7827.53. The flaw can be triggered by a crafted HTML page. If an attacker can compromise the renderer process, they may use the freed memory to execute arbitrary code, effectively escaping the browser's sandbox and potentially gaining full system access. This corresponds to CWE‑416, a use‑after‑free weakness.

Google Chrome for Android versions earlier than 149.0.7827.53 are susceptible. The issue is confined to the Android edition; other platforms or later releases are not affected. Devices running these versions and which allow arbitrary HTML to be loaded in the renderer process are at risk.

The flaw carries a high severity rating according to Chromium. The CVSS score is 8.3, indicating high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified. The attack requires an attacker already able to run malicious code in the renderer process, typically by serving a crafted web page. A successful sandbox escape would give the attacker full control over the device, bypassing browser isolation. Because the vulnerability is not listed in CISA’s KEV catalog, there is no current evidence of widespread exploitation, but the high severity suggests urgency in applying the fix.