A use‑after‑free flaw in Chrome’s Glic library allows a remote attacker who has already compromised the renderer process to potentially escape the process sandbox via a crafted HTML page, which could enable arbitrary code execution.

The vulnerability affects Google Chrome on all platforms when the browser version is older than 149.0.7827.53. Users that have not installed the update remain vulnerable; no other vendors or products are listed as affected.

The flaw has a CVSS score of 8.3, indicating high severity, while the EPSS score of <1% reflects a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to first compromise the renderer process, which can occur through malicious web content. A successful exploit may allow the attacker to escape the sandbox and execute arbitrary code on the host system.