The vulnerability is a use‑after‑free flaw (CWE‑416, CWE‑364) in the Cast component of Google Chrome. When a malicious Cast session sequence is received, a locally running Chrome process may dereference freed memory, allowing execution of arbitrary code. The defect grants the attacker the ability to run code with the privileges of the browser process, potentially compromising the hosting system. The impact is limited to a local network segment where the attack traffic originates, but the damage can be system‑wide if execution succeeds.

Google Chrome browsers whose version is prior to 149.0.7827.53 are affected, including any desktop installations using the Cast feature. Versions equal to or newer than that release contain the patch.

The CVE has a high severity rating in Chromium’s internal assessment and a public CVSS score of 8.8. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploits yet. Nevertheless, because the flaw is triggered by network traffic, an attacker on the same local network segment can launch an active attack, making the risk moderate to high for exposed systems. Exploitation requires the victim to have a running Chrome instance listening for Cast traffic.