A use‑after‑free vulnerability in Chrome’s MediaStream component allows a remote attacker to trigger arbitrary code execution within the browser sandbox by serving a specially crafted HTML page. The flaw resides in the handling of media stream objects and, based on the description, it is inferred that it can be triggered without any user interaction beyond loading the malicious content.

Google Chrome versions earlier than 154.0.8037.97 are affected. The issue was present in the stable channel before the October 2026 update that shipped the fix.

The vulnerability is classified as high severity and enables remote code execution. Because the exploit can be executed from a web page, a remote attacker does not need privileged access to the host system. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit at the time of this analysis. Nonetheless, the lack of mitigations in the browser allows a potential attacker to leverage the flaw via a crafted HTML page.