The vulnerability is a use‑after‑free flaw in the WebGL implementation of Google Chrome for Android that allows a remote attacker to execute arbitrary code outside the browser sandbox through a specially crafted HTML page. This flaw provides the attacker with full control over the compromised device, enabling data theft, credential compromise, or further propagation of malware. It is classified as a critical WebGL vulnerability with a CWE‑416 type.

The flaw affects Android devices running Google Chrome prior to version 153.0.8010.36. Any Chrome installation capable of processing WebGL graphics is susceptible if it has not been updated to the patched release.

The exploitation vector is a remote attack delivered through an HTML page rendered by Chrome. The CVSS score of 9.6 indicates critical severity, and the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered by a purely client‑side payload, providing powerful bypass of protection mechanisms; proper access controls are overridden and the use‑after‑free allows direct memory manipulation, giving the attacker full control over the device.