A use‑after‑free flaw in the mobile version of Google Chrome, present before version 157.0.8103.38, allows a maliciously crafted HTML page to corrupt memory and launch arbitrary code outside the browser sandbox. The vulnerability is a classic example of CWE‑416: Use After Free, which can lead to full system compromise if exploited successfully. The attacker could deploy malicious content through social‑engineering techniques, such as phishing, to trick a user into visiting the page.

All mobile installations of Google Chrome running versions earlier than 157.0.8103.38 are affected. This includes the stable channel for Android devices and any other mobile platforms distributed by Google that ship the vulnerable build.

The flaw is rated Medium in Chromium’s internal severity scale and is not yet listed in CISA’s KEV catalog. No EPSS score is available, but the required conditions—delivery of a malicious HTML page to a mobile user and a successful social‑engineering effort—make exploitation feasible for determined adversaries. Attackers can initiate exploitation remotely, but they must convince a user to open the crafted page, typically via phishing. Once executed, the code runs with the privileges of the Android sandbox and, because the bug allows escaping that sandbox, the attacker can achieve arbitrary code execution on the device.