Chromoting, the remote desktop component of Google Chrome on macOS, contains a use-after-free flaw that allows a remote attacker to execute arbitrary code. The vulnerability is triggered by malicious network traffic directed to a Chrome instance running a version prior to 149.0.7827.53. Exploiting the flaw can lead to full control of the affected device, compromising confidentiality, integrity and availability.

Any macOS machine that has Google Chrome installed with a version earlier than 149.0.7827.53 and has Chrome Remote Desktop enabled is affected. Versions 149.0.7827.53 and later contain the fix.

The vulnerability has a CVSS score of 8.1, indicating high severity, and is rated critical by Chromium. While the EPSS score is not published and the issue is not listed in the CISA KEV catalog, the use-after-free condition could be exploited over a network connection to a vulnerable Chrome instance. Successful exploitation grants the attacker arbitrary code execution privileges on the host system.