A use‑after‑free flaw in Chrome’s Autofill component on Android allows a remote attacker to supply a specially crafted HTML page that can potentially trigger a sandbox escape. This gives the attacker the ability to break out of the browser’s sandbox and execute code with native privileges or to read protected data, elevating a threat that was originally localized to the rendering process into a system‑level compromise. The weakness is classified as CWE‑416, highlighting the improper release and subsequent reuse of memory.

All installations of Google Chrome for Android running a version earlier than 150.0.7871.115 are affected. The issue is present in the standard Chrome release channel for the Android platform and does not appear to be limited to specific device models or OEM builds.

The vulnerability is considered high severity, but it requires the user to load a malicious HTML page. EPSS data is unavailable, and the issue has not been listed in the CISA Known Exploited Vulnerabilities catalog. Consequently, while the exploitability is low to moderate by default, the impact is severe if an attacker can lure a user into visiting a malicious site. The most likely attack vector is standard web browsing, where a phishing or malicious site delivers the harmful payload. No public exploit is known, but the code path is open for exploitation by a remote attacker.