A use‑after‑free flaw in the WebGL implementation of Google Chrome on Android allows a remote attacker, via a crafted HTML page, to potentially escape the browser sandbox and execute arbitrary code. The chromium project has classified the weakness as critical, underscoring its severity. The flaw arises from improperly managed memory after a WebGL context is freed, which an attacker can exploit when interacting with a malicious web page.

The vulnerability affects Google Chrome for Android versions prior to 149.0.7827.197. Any device running Chrome with a version earlier than this release is potentially impacted, regardless of the device brand or OS edition. Users should verify that their browsers are on the latest stable channel or newer in order to receive the patch.

The CVSS score is 9.6, indicating high severity, and no EPSS data is available, but the chromium severity level is listed as critical, indicating a high potential impact. The attack vector is via a crafted HTML page, meaning a user must be tricked into opening the malicious content in Chrome on Android. At present, the vulnerability is not listed in the CISA KEV catalog and no publicly available exploits have been documented. Nonetheless, the potential to escape the sandbox makes the risk significant for exposed devices.