Google Chrome's Blink rendering engine contains a use‑after‑free flaw that allows a remote attacker to spawn arbitrary code inside the browser sandbox. The defect is triggered when a specially crafted HTML page is rendered, causing the browser to operate on freed memory and enabling code execution. This weakness is classified as CWE‑416 and was rated as high severity by Chromium security reviewers.

The vulnerability applies to Google Chrome browsers before version 149.0.7827.197 on desktop platforms. Users of the stable channel that have not installed the June 2026 update are vulnerable.

The flaw provides remote code execution with a sandbox escape, giving an attacker the ability to execute code with the privileges of the browser process. Although EPSS data is not available, the vulnerability’s severity and known impact suggest a high likelihood of exploitation once the bug is known to attackers. It is not listed in the CISA KEV catalog.