Use after free in the Cast Streaming module of Google Chrome creates a memory corruption flaw that, when triggered by crafted network packets on the local segment, lets an attacker run arbitrary code with the privileges of the browser process. The flaw is a classic use‑after‑free (CWE‑416) that directly compromises integrity and availability of the affected systems, enabling a local network attacker to take control of the victim’s computing environment.

The vulnerability affects Google Chrome versions earlier than 149.0.7827.53 on desktop platforms. All users running a pre‑149.0.7827.53 build of Chrome are potentially vulnerable when exposed to malicious traffic on a local network.

Chromium labels the flaw as Critical, underscoring the severity. With no publicly available EPSS score and the vulnerability not listed in the CISA KEV catalog, the exact exploitation probability is unclear. Attackers would need proximity to the victim’s local network as the flaw is triggered by traffic to Cast Streaming communication channels; the absence of known public exploits makes this a moderate but non‑zero risk for environments still running the affected Chrome build.