A use-after-free flaw in the WebGL implementation of Google Chrome on Android allows an attacker to exploit a crafted HTML page. The memory corruption leads to a sandbox escape, potentially giving the attacker the ability to execute arbitrary code with higher privileges than the browser sandbox normally permits. This results in loss of confidentiality, integrity, and availability for the affected device if the vulnerability is successfully leveraged by an attacker.

Affected systems are devices running Google Chrome on Android with versions prior to 149.0.7827.197. The issue is specific to the stable channel and does not apply to newer releases beyond that point.

The vulnerability has a CVSS score of 9.6, signifying critical severity. EPSS information is not available, and the vulnerability is not listed in CISA's KEV catalog. Because the flaw is triggered by an externally supplied HTML page, a remote attacker who can serve malicious content to a user’s browser could potentially exploit the vulnerability. The absence of intervening mitigations in the affected Chrome versions increases the likelihood that exploitation could succeed once the exploit code is delivered.