Use after free in the Cast Streaming module of Google Chrome creates a memory corruption flaw that, when triggered by crafted network packets on the local segment, lets an attacker run arbitrary code with the privileges of the browser process. The flaw is a classic use‑after‑free (CWE‑416) and improper handling of system resources (CWE‑825) that directly compromises integrity and availability of the affected systems, enabling a local network attacker to take control of the victim’s computing environment.

The vulnerability affects Google Chrome versions earlier than 149.0.7827.53 on desktop platforms. All users running a pre‑149.0.7827.53 build of Chrome are potentially vulnerable when exposed to malicious traffic on a local network.

Chromium labels the flaw as Critical, underscoring the severity. With a CVSS score of 8.8 and an EPSS score of 0.00012, the exploitation probability is low but nonzero; the vulnerability is not listed in the CISA KEV catalog. Attackers would need proximity to the victim’s local network as the flaw is triggered by traffic to Cast Streaming communication channels; although public exploits are not yet known, the combination of a high CVSS score and low but nonzero EPSS score warrants a moderate to high risk assessment for environments still running the affected Chrome build.