CVE-2026-16423 is a use-after-free vulnerability in the UI of Google Chrome before version 150.0.7871.182. An attacker who convinces a user to engage in certain UI gestures on a maliciously crafted HTML page may trigger heap corruption, potentially leading to arbitrary code execution or other impacts. The vulnerability is rated high severity with a CVSS score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor has published an advisory indicating a stable channel update for desktop Chrome, implying a fix is available in version 150.0.7871.182.

Successful exploitation could lead to heap corruption, allowing an attacker to execute arbitrary code or cause denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. Exploitation requires user interaction via specific UI gestures on a crafted HTML page. There are no known exploits in the wild at this time.

Update Google Chrome to version 150.0.7871.182 or later, where this vulnerability is fixed. The vendor advisory confirms the availability of a stable channel update addressing this issue. Users should apply this update promptly to mitigate the risk.