A use‑after‑free flaw in the Ozone rendering backend of Google Chrome on Linux allows an attacker to manipulate heap memory within the browser process. By crafting a malicious HTML page that forces a user to perform specific UI gestures, the browser may free an object that is later reused, leading to heap corruption. The vulnerability is classified as CWE‑416 and could allow an attacker to potentially control memory on the affected process, although no confirmed exploitation has been reported.

Linux installations of Google Chrome earlier than version 150.0.7871.47 that use the Ozone backend are affected. The flaw is confined to the browser process and does not directly compromise the operating system.

The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% suggests a low chance of exploitation. The vulnerability is not listed in CISA’s KEV catalog, and no wild exploits are known. A successful attack would require convincing a user to engage with malicious content that triggers the specific UI gestures. If the conditions are met, the corrupted heap could be exploited to gain memory control, but this has not yet been demonstrated in practice, so the overall risk remains moderate.