The vulnerability is a use‑after‑free condition in the WebView component of Google Chrome on Android. This represents a use‑after‑free (CWE‑416) that results in use of freed memory (CWE‑825). When a renderer process is already compromised, an attacker can serve a specially crafted HTML page that triggers the freed memory usage, potentially allowing execution of arbitrary code outside the browser sandbox. The flaw was classified as Critical by Chromium and could lead to full system compromise if exploited.

Devices running Google Chrome for Android earlier than version 148.0.7778.216 are affected. The bug resides in the WebView implementation tied to the renderer process in those releases.

The flaw carries a CVSS score of 8.3 (High) and the EPSS score is less than 1 %. It is not listed in CISA’s KEV catalog. Exploitation requires an already compromised renderer process and the delivery of a crafted web page, making it a remote attack scenario that relies on browser interaction. Given the high severity and potential for system compromise, organizations should treat this as an urgent vulnerability.