The vulnerability is a use‑after‑free bug in ANGLE, the graphics abstraction layer used by Chrome. It allows a malicious renderer that has already been compromised to access freed memory. The exploit can lead to a sandbox break, giving the attacker unauthorized system access. The weakness is classified as CWE‑416 and can result in both data theft and control over the affected system.

Google Chrome versions earlier than 149.0.7827.53 are affected. This includes all stable desktop releases before that build. No specific operating system is limited; the issue exists across all platforms where ANGLE is enabled.

The CVSS score is unknown in the supplied data, but the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires a compromised renderer process and a crafted HTML page, the likelihood of exploitation is moderate to high where users are browsing potentially malicious content and the renderer is not fully sandboxed. The potential impact is significant, allowing remote code execution if the sandbox escape succeeds.