A use-after-free flaw located in the WebView component of Google Chrome for Android allows a remote attacker that delivers a carefully crafted HTML page to trigger a heap corruption. This vulnerability could compromise the confidentiality, integrity, and availability of the victim system if exploited, potentially enabling arbitrary code execution.

All Android devices running Google Chrome older than version 149.0.7827.53 are affected. The issue was present in the stable channel on Android and affects any application that embeds Chrome’s WebView component.

The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, indicating no known public exploits at this time. However, the remote nature of the attack vector – delivering a malicious HTML page – makes it theoretically exploitable from a web page that a user visits or a web app that loads untrusted content. The Chromium severity is Medium, yet due to the potentially serious consequence of heap corruption, the risk remains high until patched.