A use‑after‑free flaw in the Chromoting component of Google Chrome, found in versions before 149.0.7827.53, lets an attacker send crafted network packets to trigger a memory error that can lead to execution of arbitrary code. The weakness is classified as CWE‑416 and was rated Critical by Chromium, meaning successful exploitation would give the attacker full control over the victim’s machine.

Google Chrome browsers that use the Chromoting feature in any version earlier than 149.0.7827.53 are affected. No other vendors or products are listed in the CNA data.

The CVSS score of 8.8 indicates a high severity, while an EPSS score of <1% shows a very low but non‑zero exploitation probability. The flaw is not currently listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would need to initiate or manipulate a Chromoting session over the network to exploit the vulnerability, which is remote over a network connection. Because the vulnerability enables arbitrary code execution, the risk remains significant until the issue is patched.