A use‑after‑free flaw exists in the Payments component of Google Chrome for macOS that allows an attacker to run arbitrary code by loading a specially crafted HTML page. This memory mismanagement (CWE‑416) means that user data is freed prematurely and later accessed, giving an attacker a foothold to execute code at native privileges. The vulnerability has a high severity rating in the Chromium security team, indicating it can be leveraged for full compromise of the affected machine.

The issue affects Google Chrome on Mac systems running any version prior to 149.0.7827.103. All users of the stable desktop channel before this build are potentially exposed, regardless of other configuration settings.

The vulnerability is rated as high severity by the Chromium security team and can be exploited remotely via a crafted web page. The CVSS score is 8.8. The EPSS score is not available and it is not listed in the CISA KEV catalog, indicating that there have been no documented widespread exploitations so far. An attacker can trigger the flaw by instructing a victim to open a malicious web page containing the crafted HTML payload, allowing remote execution without requiring local access or elevated privileges.