A use‑after‑free flaw exists in the Ozone component of Google Chrome on Linux, where a crafted HTML page can trigger a dangling pointer in memory. This bug enables a remote attacker to potentially break the browser's sandbox and execute code with higher privileges. The nature of the vulnerability is an invalid memory access leading to an arbitrary code execution scenario beyond the browser process. The flaw can be classified as a use‑after‑free (CWE‑416) and involves improper memory handling (CWE‑825).

Google Chrome browsers running on Linux platforms with a version earlier than 149.0.7827.53 are affected. Users of the stable channel are at risk until they upgrade to the patched release or later.

The issue has a CVSS score of 9.6 and a very low EPSS score of less than 1%. It is not listed in the CISA KEV catalog. Attackers would need to supply a malicious HTML page that the user opens or visits, after which the use‑after‑free condition could be triggered and the sandbox bypassed. Given the lack of exploitation data, the exact likelihood is uncertain, but the potential impact of allowing privileged code execution in a desktop environment justifies treating it as a critical risk that must be mitigated promptly.