A use‑after‑free flaw in Blink, Google’s rendering engine used by Chrome, allows a crafted HTML page to corrupt memory and execute arbitrary code inside Chrome’s sandbox. The vulnerability is a classic pointer misuse (CWE‑416) and improper handling of released memory (CWE‑825) that can compromise the process hosting the user’s browser session, potentially leading to further exploitation of the underlying system.

Google Chrome versions earlier than 149.0.7827.53 on all supported platforms are affected. The flaw exists in the core Blink engine and therefore applies to both desktop and mobile builds using this rendering path.

The attack vector is remote: a malicious web page can trigger the heap corruption when loaded in Chrome. The EPSS score is 0.0008 (less than 1%), indicating a low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Chromium rates the severity as medium, and the CVSS score of 8.8 reflects the potential for arbitrary code execution while remaining confined to the sandbox unless an escape is achieved. Given the public nature of web content, exploiting this flaw is technically straightforward for an attacker with control over an HTML page.