A use‑after‑free flaw in Chrome’s Views component allows a remote attacker to craft a malicious HTML page that, when a user performs certain UI gestures, can cause heap corruption. The corrupted heap could be leveraged to execute arbitrary code on the victim’s machine. This weakness is catalogued as CWE‑416.

The vulnerability affects all Chrome installations older than 150.0.7871.47. Users of the affected builds on desktop platforms are potentially exposed.

No EPSS score is published, and the flaw is not listed in CISA KEV, indicating no widely known public exploits at this time. Nevertheless, the flaw is considered high severity by Chromium, and an attacker can gain the required user interaction. Since the vulnerability requires a user to engage in specific UI gestures, the attack surface depends on user behavior, but if an attacker can convince a user to visit the crafted page, they could achieve code execution. Fixing the issue requires installing the patched Chrome release.