A use‑after‑free bug in the V8 JavaScript engine of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox when a user opens a specially crafted HTML page. The flaw occurs when the engine frees a memory region that is still referenced, leading to memory corruption and code execution with the same privileges as the browser process. This matches CWE‑416 and involves improper bounds checking weaknesses as shown by CWE‑825.

Google Chrome versions prior to 149.0.7827.53 on all supported platforms (Windows, macOS, and Linux) are vulnerable. Any visitor to a malicious web page while running one of these Chrome versions could trigger the attack.

Chromium rates the issue as medium severity, but the CVSS score of 8.8 indicates a high severity impact. The EPSS score is below 1 % and the flaw is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. However, the attack can be triggered from a remote web page, so the surface exists wherever a user can view malicious content. Successful exploitation requires user interaction (opening the page) and depends on a sandbox escape; the code would run within the browser context.