A use‑after‑free flaw exists in the Navigation component of Google Chrome for Android, allowing a remote attacker to trigger execution of arbitrary code beyond the normal sandbox when a crafted HTML page is rendered. The vulnerability stems from improperly deallocating memory that is still referenced, which can be abused to inject and run malicious code.

Google Chrome for Android versions prior to 157.0.8103.38 are vulnerable. Any device using one of these releases and visiting a page containing malicious markup may be affected.

The severity is high and the CVSS score reflects that. EPSS data is not available and the flaw is not listed in CISA KEV. The likely attack vector is a malicious or compromised website that serves specially crafted HTML to a user’s browser; this is inferred from the described exploitation method. Successful exploitation would result in compromise of the device and potential data exfiltration or further attacks. The exploit requires user interaction to load the page, but once that occurs, code execution occurs outside the browser sandbox.