This vulnerability is a use‑after‑free defect in Chrome for iOS that can allow an attacker who already compromised the renderer process to escape the browser sandbox through a crafted HTML page. If successful, the attacker could execute arbitrary code with elevated privileges inside the device. The flaw is identified as CWE‑416 and is rated high by Chromium’s security severity.

Google Chrome for iOS versions prior to 149.0.7827.53 are affected. The flaw is present in the renderer process of the browser and is specific to the iOS build of Chrome.

The CVSS score is 8.3, indicating high severity, yet the exploit requires a prior compromise of the renderer process, which is a non‑trivial prerequisite. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog. Despite this, the potential for a sandbox escape that could lead to remote code execution makes the risk significant in environments where malicious or compromised web content can be loaded by the vulnerable Chrome app.