The vulnerability is a use‑after‑free flaw (CWE‑416) in the WebRTC component of Google Chrome, allowing a remote attacker to run arbitrary code inside the browser sandbox through a crafted HTML page. This flaw can compromise confidentiality, integrity, and availability by letting the attacker execute code in the context of the browser. The flaw also involves improper handling of reference counts leading to error conditions (CWE‑825).

Google Chrome users running any release before version 149.0.7827.53 are vulnerable. The bug resides in the WebRTC stack that handles real‑time communication in the browser. No other products or vendor/branch are affected.

Chromium classifies it as a High severity issue. The CVSS score is 8.8, the EPSS score is 0.00071 (<1%) and the vulnerability is not listed in CISA’s KEV catalog. The fault allows a malicious web page to trigger the use‑after‑free, which is an inferred remote attack vector. Successful exploitation would grant an attacker arbitrary code execution inside the sandbox, giving them control over the user’s session and potentially the host system if sandbox escapes were achievable. High severity combined with the potential for widespread exploitation via the Internet makes it a significant risk.