The vulnerability is a use‑after‑free bug in the Dawn rendering engine of Google Chrome on Android. The flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by loading a specially crafted HTML page. The impact is the ability to run code with the privileges of the Chrome process, potentially compromising the device’s confidentiality and integrity. The associated weakness is identified as CWE‑416: Use After Free.

Google Chrome for Android versions prior to 152.0.7977.75 are affected. The issue exists in the Dawn rendering engine used in these releases.

The CVSS score is 9.6, indicating a High severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. A remote attacker needs the ability to serve a malicious HTML page to the target device. The likely attack vector is a crafted web page that exploits the use‑after‑free, leading to arbitrary code execution outside the Chrome sandbox. The absence of reported exploitation statistics means an attacker could potentially develop an exploit, but the practical risk depends on the ability to lure the target to the malicious page.