ViewTransitions in Google Chrome before version 149.0.7827.103 contain a use‑after‑free bug that lets an attacker construct a malicious HTML page to trigger the vulnerability. The flaw allows execution of arbitrary code within the browser's sandbox, effectively bypassing the browser isolation boundary. This is a clear instance of CWE‑416, use‑after‑free, and CWE‑772, and the consequence is the compromise of confidentiality and integrity of data processed by Chrome. The impact is system‑wide for any user who loads the crafted page, potentially giving the attacker control over the victim’s browser session.

Google Chrome users running any release prior to 149.0.7827.103 are affected. The vulnerability is reported for the stable channel and applies to all platforms where the ViewTransitions feature is enabled.

The CVSS score of 8.8 reflects high severity and the EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. However, the flaw is exploitable via a web page that an attacker can host, making it remotely accessible. Attackers would need to lure a user to a malicious site, but no further conditions are specified. Given the high severity and the documented remote code execution capability, the risk to any user who can be tricked into loading the crafted content is significant.