A use‑after‑free flaw in the Web Authentication implementation of Google Chrome prior to build 149.0.7827.197 can cause heap corruption when a maliciously crafted Chrome Extension is loaded. This vulnerability can be exploited to execute arbitrary code or crash processes, compromising the confidentiality, integrity or availability of the user's data and browser session.

All installations of Google Chrome that are earlier than version 149.0.7827.197 are affected. The flaw was addressed in the June 2026 stable channel update.

The vulnerability is classified as high severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The likely attack scenario requires the attacker to persuade a user to install a malicious extension; once the extension is loaded, the use‑after‑free can be triggered to corrupt heap memory and potentially gain code execution within the renderer process. The exploitability depends on user interaction and the presence of a malicious extension.