A use‑after‑free flaw was discovered in the Autofill component of Google Chrome on macOS, affecting releases prior to 149.0.7827.115. The bug allows a crafted HTML page to trigger an invalid memory access that can corrupt heap data, which in turn can lead to arbitrary code execution if sufficient conditions are met.

All users running Google Chrome on macOS with a version older than 149.0.7827.115 are impacted. The vulnerability resides solely in the Chrome browser’s autofill logic and does not affect other operating system components or browsers.

The flaw carries a high severity rating in Chromium’s internal assessment. While an EPSS score is unavailable, the missing KEV listing suggests no publicly known exploit is active yet; however, the remote nature of the attack vector—requiring only a malicious web page—makes the vulnerability technically exploitable by any visitor to a compromised site. The potential consequence is remote code execution or denial of service on affected machines.