Use‑after‑free in the audio subsystem of Google Chrome allows a memory corruption that can lead to a sandbox escape. The flaw exists in Windows builds of Chrome prior to 149.0.7827.53. When an attacker controls the renderer process, a specially crafted HTML page can trigger the freed memory access and break out of the renderer sandbox, enabling the attacker to run code with elevated privileges. This type of weakness falls under CWE‑416 and is considered a high‑severity exploitation vector.

Google Chrome for Windows, versions older than 149.0.7827.53, are vulnerable. All users running these builds are at risk if they visit malicious web pages that can upload a crafted HTML snippet to the browser. The vulnerability does not impact non‑Windows platforms or newer Chrome releases.

The CVE has a CVSS score of 8.3, classifying it as high severity. The likelihood of exploitation is unknown due to an unavailable EPSS score. However, the required attacker condition – compromising the renderer process – can be satisfied via phishing or malicious sites. The absence of a KEV listing suggests the vulnerability is not yet widely exploited, but its high severity warrants immediate attention. The attack vector is remote, dependent on a user visiting or rendering a malicious web page, and can lead to privilege escalation if successful.