A use‑after‑free flaw in the V8 JavaScript engine allows a remote attacker who convinces a user to perform specific UI gestures to execute arbitrary code inside the sandbox. The weakness is a classic memory safety error (CWE‑416) that gives the attacker execution control after a freed object is reused. The impact is confined to the browser's sandbox but still permits attacker‑selected code execution, bypassing many of the browser’s security protections.

The vulnerability affects Google Chrome browsers running any version prior to 149.0.7827.53. Users of earlier stable channel builds are exposed; newer releases have the fix applied.

The exploit requires social engineering or a malicious web page to prompt the user into the triggering gestures. No evidence of active exploitation is reported and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, so the likelihood is unclear, but the medium severity rating indicates a moderate risk if the browser is used normally. Attackers can launch code execution inside the sandbox, making the threat significant enough to warrant a patch but unlikely to cause site‑wide compromise without persistence mechanisms.