The flaw is a use‑after‑free in Chrome’s Cast integration that can corrupt heap allocations when malicious network traffic is received. This constitutes CWE‑416 and CWE‑825 and, if successfully triggered, can potentially allow an attacker to execute arbitrary code in the browser process, leading to compromise of the client machine.

Google Chrome on all platforms. Releases earlier than 149.0.7827.53 are affected. Chrome 149.0.7827.53 and later contain the fix referenced in the update blog.

With a CVSS score of 8.8, Chromium labels the issue as Critical. The EPSS score of 0.00012 indicates a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The attack vector requires the attacker to be on the same local network segment and to send crafted traffic that the Cast code will process; the attacker does not need to remotely access the victim’s machine over the public Internet. Successful exploitation would give code execution in the context of the Chrome user.