Google Chrome before version 149.0.7827.53 contains a use‑after‑free bug in the Input module. A maliciously crafted HTML page can trigger the defect and potentially allow the attacker to escape the browser sandbox, moving from a restricted execution context into higher‑privilege code execution. The flaw is a classic memory corruption vulnerability identified as CWE‑416.

The vulnerability affects all installations of Google Chrome older than 149.0.7827.53, regardless of platform. Any user who visits a maliciously forged HTML page while running an affected version is at risk.

While the Chromium project rates the severity as low, the need for a malicious page to be loaded by a user limits its exposure. EPSS is not available, and the issue is not listed in CISA’s KEV catalog, indicating no known widespread exploitation at this time. Nevertheless, if an attacker controls the content or can coerce a user into loading the payload, sandbox escape could lead to compromise of the host system.