A use‑after‑free flaw in Chrome’s Canvas rendering allows a crafted web page to trigger memory corruption within the browser sandbox, enabling execution of arbitrary code supplied by an attacker. This flaw is classified as CWE‑416 and CWE‑825 and can compromise confidentiality, integrity, and availability if exploited, including the potential to escape the sandbox and affect the underlying operating system.

Google Chrome versions earlier than 149.0.7827.53 are affected. All platforms running that build, including Windows, macOS, and Linux, remain vulnerable until the security update is applied.

The CVSS score of 8.8 denotes a high severity vulnerability. The EPSS score of less than 1% indicates a very low current probability of exploitation, and it is not listed in CISA’s KEV catalog. Exploitation can occur when a user visits or opens a malicious or compromised web page that renders a specially crafted Canvas element, leveraging the sandboxed browser environment as the attack surface.