Use‑after‑free in the GFX module of Google Chrome on macOS allows a remote attacker to execute arbitrary code by loading a crafted HTML page. The flaw is a classic use‑after‑free (CWE‑416) and can compromise the entire browser process. Because the attack relies on the browser rendering malicious content, successful exploitation gives the attacker the privileges of the user’s Chrome instance.

Google Chrome for macOS versions prior to 150.. The issue applies to the stable channel and affects all macOS installations that run these outdated builds.

Chromium rates this vulnerability as high severity, with a CVSS score of 8.8 and an EPSS score of <1% indicating a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but it permits remote code execution via a browser. The likely attack vector is remote, requiring only a crafted web page to be opened in the affected browser, as suggested by the description. Based on the description, it is inferred that the exploit requires no special privileges beyond navigating to malicious content.