The vulnerability is a use‑after‑free bug in ANGLE, the graphics abstraction layer used by Chrome. It allows a malicious renderer that has already been compromised to access freed memory. The exploit can lead to a sandbox break, giving the attacker unauthorized system access. The weakness is classified as CWE‑416 and CWE‑825 and can result in both data theft and control over the affected system.

Google Chrome versions earlier than 149.0.7827.53 are affected. This includes all stable desktop releases before that build. No specific operating system is limited; the issue exists across all platforms where ANGLE is enabled.

With a CVSS score of 8.3, the vulnerability is considered high severity. The EPSS score is <1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires a compromised renderer process and a crafted HTML page, the likelihood of exploitation is moderate to high where users are browsing potentially malicious content and the renderer is not fully sandboxed. The potential impact is significant, allowing remote code execution if the sandbox escape succeeds.