Technical impact
The vulnerability is a use‑after‑free flaw in WebShare that can allow a sandbox escape through a crafted HTML page, if the attacker has already compromised the renderer process. The flaw could enable an attacker to gain higher privileges or execute code beyond the normal browser sandbox, threatening the confidentiality and integrity of the device. This weakness is categorized as CWE‑416 and CWE‑825.
Affected Systems
Google Chrome, as used on Android devices, is affected in all versions prior to 149.0.7827.53. The issue was reported for the stable channel and applies to the renderer component of Chrome on Android.
Risk and Exploitability
The CVSS score for this vulnerability is 8.3, indicating a high severity, and the EPSS score is <1%, suggesting a low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector involves a crafted HTML page that triggers the use‑after‑free once the renderer process has been compromised, a path that would typically require the attacker to already have some foothold in the browser environment.
Debian DSA