The vulnerability is a Use‑After‑Free in the Chrome renderer process that could allow a remote attacker who has already compromised that process to escape the browser sandbox and gain elevated privileges. The flaw is classified as CWE‑416 and was rated with high severity by Chromium security reviewers. Successful exploitation could lead to execution of arbitrary code on the system.

The issue affects Google Chrome versions prior to 149.0.7827.155 on desktop browsers, as released to the stable channel in June 2026. The specific affected build is the stable channel before the release of 149.0.7827.155. No other products or operating system combinations are explicitly listed as affected.

The EPSS score is reported as less than 1 %, indicating a low probability of widespread exploitation at present, and the vulnerability is not catalogued in the CISA KEV list. The attack requires a compromised renderer process and the delivery of a crafted HTML page, so the primary vector is a malicious web page held by an attacker with web‑access. The overall risk remains high for environments that allow the vulnerable Chrome version to load untrusted web content.