The vulnerability is a use‑after‑free flaw in the WebRTC component of Google Chrome. An attacker can trigger the flaw by serving a specially crafted HTML page, causing Chrome to read and execute memory that has already been freed. This gives the attacker the ability to run arbitrary code inside the browser’s sandbox, potentially allowing them to exfiltrate data or perform actions on the victim’s machine.

Affected systems are all installations of Google Chrome prior to version 149.0.7827.53. The flaw exists in the stable channel releases published before that version. Users running earlier Chrome versions with WebRTC enabled are vulnerable.

The flaw leads to a high‑severity condition reflected by a CVSS score of 8.8; the exploitable path requires only the victim to load the malicious page, making the attack vector remote and user‑friendly. No EPSS data is available, and the issue is not listed in the CISA KEV catalog, but the potential impact justifies timely remediation. An unpatched user can be compromised through a web page or email attachment leading to code execution within the browser sandbox.