Use‑after‑free vulnerability in the Autofill component of Google Chrome on Windows allows an attacker to execute arbitrary code by serving a malicious HTML page to the user. The flaw arises when the browser accesses freed memory, enabling code injection and full control of the browser process. This can result in compromise of the user’s data and system.

Google Chrome browsers running on Windows prior to version 149.0.7827.197 are affected. Users who have not updated to the fixed release are at risk.

The vulnerability has a CVSS score of 8.8, indicating a high level of severity. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability, and the issue is not listed in the CISA KEV catalog. An attacker can exploit it remotely by causing a victim to load a crafted HTML page in the browser, triggering the use‑after‑free and executing arbitrary code with the privileges of the browser process.