An out‑of‑bounds memory access in Chrome's WebRTC implementation allows a malicious web page to trigger a use‑after‑free and run arbitrary code within the browser sandbox. The flaw can be abused to overwrite or corrupt critical data structures in the JavaScript engine, enabling code execution with sandboxed privileges. The associated weaknesses are use‑after‑free (CWE‑416) and an additional flaw in handling allocated resources identified as CWE‑825.

Google Chrome browsers running a version older than 149.0.7827.53 on any supported platform are vulnerable. This includes Windows, macOS, Linux, Android, and iOS installations that have not yet applied the patch contained in the 149.0.7827.53 release.

Chromium rates the vulnerability as high severity with a CVSS score of 8.8, and the browser is commonly exposed to Internet content, making the attack vector remote. The EPSS score is less than 1 % and the issue is not listed in the CISA KEV catalog, but the ability to achieve arbitrary code execution makes it a high‑risk exposure that can be leveraged by an attacker controlling a web page or by phishing or drive‑by attacks.