A use‑after‑free condition in the Downloads handling of Google Chrome on Android allows a remote attacker to provoke heap corruption by delivering a crafted HTML page. The flaw permits the attacker to potentially execute arbitrary code or cause denial of service if the corruption leads to process takeover. The underlying weakness is a classic heap use‑after‑free (CWE‑416) and memory corruption (CWE‑825).

All Android devices running Google Chrome versions earlier than 149.0.7827.155 are affected. The vulnerability is present in the stable channel of Chrome on Android and is referenced as a high‑severity issue by Chromium security. Devices with older Chrome installations, such as 149.0.7827.154 and earlier, must be considered vulnerable.

The estimated EPSS score is below 1 %, indicating that exploitation is uncommon but not impossible. The CVSS score of 8.8 classifies the vulnerability as high severity. The flaw is not currently listed in CISA’s KEV catalog. Given the remote nature of the trigger—an attacker can supply a malicious HTML page—the attack vector is likely via phishing or social engineering. The high Chromium severity suggests significant potential impact if the vulnerability is successfully exploited. The absence of a public exploit in the data set does not preclude future development of such code.