The vulnerability is a use‑after‑free flaw in the WebRTC component of Google Chrome, allowing a remote attacker to run arbitrary code inside the browser sandbox through a crafted HTML page. This flaw can compromise confidentiality, integrity, and availability by letting the attacker execute code in the context of the browser.

Google Chrome users running any release before version 149.0.7827.53 are vulnerable. The bug resides in the WebRTC stack that handles real‑time communication in the browser. No other products or vendor/branch are affected.

Chromium classifies it as a High severity issue. The CVSS score is 8.8, the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The fault allows a malicious web page to trigger the use‑after‑free, which is an inferred remote attack vector. Successful exploitation would grant an attacker arbitrary code execution inside the sandbox, giving them control over the user’s session and potentially the host system if sandbox escapes were achievable. High severity combined with the potential for widespread exploitation via the Internet makes it a significant risk.