Use after free vulnerability in the USB handling component of Google Chrome for Android allows an attacker to craft a malicious HTML page that, when opened, may cause a sandbox escape. The flaw could enable arbitrary code execution outside the browser sandbox, potentially compromising device resources and user data. The weakness is a classic use‑after‑free error (CWE‑416) and a memory deallocation improper use (CWE‑825).

Google Chrome for Android versions earlier than 149.0.7827.53 are affected. Users running these builds on Android devices are at risk when they load a malicious HTML page from USB storage.

With a CVSS score of 8.8, this vulnerability is classified as high severity. It is not listed in the CISA KEV catalog, indicating no known active exploitation in the wild. The attack can be performed remotely by delivering a malicious HTML page through USB access, which an attacker can control if the device is compromised or the user is tricked into opening malicious content. The likelihood of exploitation is uncertain but potentially high given the remote nature of the vector and the difficulty in defending against HTML-based attacks. The EPSS score is < 1%, so the risk assessment is based on the high CVSS and the remote sandbox‑escape potential.