The vulnerability is a use-after-free flaw in the Omnibox component of Google Chrome that can lead to heap corruption when a specially crafted HTML page is viewed and the user performs certain UI gestures. If the heap is corrupted, an attacker could potentially execute arbitrary code or cause a denial of service. This weakness is classified as CWE-416.

Google Chrome versions prior to 149.0.7827.53 on the stable channel are affected. The issue applies to all platforms that ship the impacted browser release; no other products or vendors are listed.

The CVSS score is medium, but the exact value is not provided; the EPSS score is not available, so the exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves a remote attacker delivering a malicious web page that forces a user to engage in specific UI interactions with the Omnibox. The user must visit the page while running the affected Chrome version; the exploit requires user interaction but could lead to arbitrary code execution if the heap corruption is successfully triggered.