An attacker who has compromised the Chrome renderer process can exploit a use‑after‑free in the Serial implementation to gain code execution outside the sandbox, effectively breaking out of the renderer’s restricted environment. The vulnerability is a classic memory‑corruption flaw (CWE‑416) that could allow privilege escalation if the object is accessed after it has been freed.

Google Chrome on Android versions prior to 149.0.7827.53 are affected. The issue is reported for the stable channel and applies to all devices running the vulnerable Chrome revision.

The EPSS score is not available, but the CVE was listed as Medium severity by Chromium. It is not in the CISA KEV catalog, suggesting no publicly disclosed exploits at the time of this analysis. The likely attack vector involves an adversary delivering a specially crafted HTML page that becomes served to a renderer process already compromised through a separate social‑engineering or malware vector. Once the renderer has been subverted, the use‑after‑free can lead to execution of attacker‑controlled code, potentially allowing full system compromise.