A use after free flaw in the WebSockets implementation of Google Chrome prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code within the browser’s sandbox by serving a specially crafted HTML page. The vulnerability is a classic memory management error (CWE‑416) and a memory corruption issue (CWE‑825) that can lead to code execution inside the browser process, potentially exposing confidential data or enabling additional attack stages.

All installations of Google Chrome on which the affected version is running—any system that has Chrome … prior to 149.0.7827.53 is exposed. The issue is not limited to a specific operating system or device type.

An EPSS score of 0.00071 is reported, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, highlighting that official exploit data is currently missing. The CVSS score of 8.8 indicates high severity. The likely attack vector involves delivering a malicious web page that opens a WebSocket connection, triggering the use after free condition. Because the code runs inside Chrome’s sandbox, an attacker could gain a foothold in the browser and, if sandbox restrictions are bypassed, potentially affect the wider system.