The vulnerability is a use‑after‑free flaw in the File Input handling of Google Chrome on macOS, allowing a remote attacker who triggers a user to perform specific UI gestures on a crafted HTML page to potentially escape the browser sandbox and execute code with higher privileges. The flawed code can be triggered after the browser reclaims memory, leading to execution of arbitrary code; the requestor notes the Chromium security severity as Medium.

Google Chrome version 149.0.7827.53 and earlier on macOS are affected. The issue applies to all fleet installations of Chrome on macOS that have not upgraded beyond the specified version.

No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, but the absence of these metrics does not diminish the potential impact. Exploitation requires a crafted HTML page, user interaction, and the victim’s device must run a vulnerable Chrome instance on macOS. The attack would allow the attacker to break sandbox confinement, enabling remote code execution with the privileges of the logged‑in user.