A use‑after‑free flaw was discovered in the Network component of Google Chrome before version 149.0.7827.103. An attacker can deliver a specially crafted HTML page to a user and exploit the deallocation bug to execute arbitrary code inside the browser’s sandbox environment. The vulnerability is a classic use‑after‑free (CWE‑416) that also aligns with CWE‑825, allowing code execution with the privileges granted to the sandboxed renderer, leading to potential compromise of the user’s system or data.

Google Chrome browsers running versions prior to 149.0.7827.103 are affected. The flaw applies to all platforms where the Network layer is present, as no vendor‑specific version filtering was indicated. Updating to the fixed build eliminates the use‑after‑free condition.

The flaw has a CVSS score of 9.6, indicating a high severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote and requires a malicious HTML page to be viewed in the affected browser. The likelihood of exploitation is uncertain, but the high severity and the ability to execute code in a sandboxed process make it a significant risk for users who have enabled unsafe content or visit untrusted sites.