A use‑after‑free bug in Chrome’s File Input on Linux allows a remote attacker to trigger heap corruption by loading a specially crafted HTML page, potentially leading to arbitrary code execution. This flaw is classified as CWE‑416 and was marked critical by Chromium security. The vulnerability enables remote exploitation from a web page hosted on an attacker‑controlled domain, giving the attacker control over memory that can be leveraged for code execution or persistence.

Google Chrome on Linux, specifically versions earlier than 149.0.7827.155. No other product or platform is listed as affected in the CNA data.

The CVSS score of 8.8 indicates a high severity exploitation potential. The EPSS score of <1% suggests that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote via a crafted HTML page, as stated in the description, and could allow an attacker to execute arbitrary code if the victim opens the malicious page in a vulnerable Chrome installation.