This CVE describes a use‑after‑free flaw in the Read Anything component of Google Chrome versions earlier than 149.0.7827.103. The defect, identified as CWE‑416 and CWE‑825, enables a remote attacker who has already compromised a renderer process to deliver a crafted HTML page that may result in a sandbox escape. Chromium rates the vulnerability as High severity.

Google Chrome browsers prior to version 149.0.7827.103 are affected, as the use‑after‑free resides in the renderer component that all desktop installations use.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 8.3 and Chromium classifies the defect as High severity. The description indicates that an attacker must first compromise a renderer process and then supply a maliciously crafted HTML page to trigger the sandbox escape. This sequence implies a higher exploitation complexity, although the input does not quantify the likelihood of successful exploitation. The likely attack vector is a malicious HTML page delivered to a compromised renderer process.