Google Chrome contains a use‑after‑free bug in the Autofill component that allows an attacker who has already compromised the renderer process to read potentially sensitive data from the renderer’s memory. The flaw is tied to CWE‑416 and CWE‑825 and is reported as a high‑severity issue by Chromium. While the vulnerability does not grant arbitrary code execution, it can leak confidential information that the renderer has access to, such as user credentials or form data that may have been stored in memory.

All desktop instances of Google Chrome versions prior to 149.0.7827.115 are affected. No specific patch level is required beyond upgrading to this or a later version. The issue applies to all platforms supported by the stable‑channel release that include the Autofill feature.

The CVSS score is 5.3, and the EPSS score is 0.00203, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have already compromised the renderer process, which typically means prior successful delivery of malicious content or exploitation of another local vulnerability. Given the lack of an easily exploitable remote vector and the requirement for local compromise, the practical risk is moderate compared to other high‑severity flaws, yet the memory disclosure could still be valuable to an adversary with renderer access.