Use‑after‑free vulnerability in the Omnibox component of Google Chrome on Android allows a remote attacker who convinces a user to perform specific UI gestures on a crafted HTML page to trigger heap corruption. This flaw can destabilize the browser or potentially lead to device compromise; however, the advisory does not explicitly state a denial of service or full compromise scenario. Based on the description, it is inferred that the heap corruption could destabilize the browser or might lead to device compromise, though this is not explicitly confirmed.

Chrome for Android versions earlier than 150.0.7871.47 are affected; newer builds contain the update that fixes the use‑after‑free flaw.

CVSS score of 8.8 indicates high severity, while EPSS <1% suggests a very low but non‑zero exploitation probability. Attack requires the user to open a crafted page and execute particular Omnibox gestures, meaning the vector is user interaction. The advisory states the flaw is not listed in CISA’s KEV catalog. No confirmed remote code execution path is provided, so further compromise is not asserted. Based on the available evidence, exploitation remains constrained to the conditions described above.