A use-after-free issue in the `VisibleSelection::nonBoundaryShadowTreeRootNode` function in the DOM implementation in Blink allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper handling of a `shadow-root` anchor.