A use‑after‑free flaw in the WebCodecs API of Google Chrome versions before 148.0.7778.216 allows a remote attacker to run arbitrary code within the browser’s sandbox. The vulnerability is a classic example of CWE‑416, where freed memory is accessed again, and it also aligns with CWE‑825, indicating additional misuse of resources that can be exploited to compromise the browser.

All users running affected Chrome versions on any platform are impacted. The flaw exists in every instance of Chrome shipped before build 148.0.7778.216, regardless of OS or device type.

The EPSS score is not supplied, and the vulnerability is not listed in CISA's KEV catalog, but its Chromium‑severity rating is high, and the CVSS score of 8.8 indicates it can be exploited to break out of the browser sandbox. Based on the description, the likely attack vector is a crafted HTML page delivered over the network and rendered by a compromised or malicious website, which would trigger the use‑after‑free during media decoding. No explicit prerequisites beyond browser access are stated, so exploitation is considered feasible for any user who visits a malicious site.