This vulnerability is a use‑after‑free flaw in the Updater module of Google Chrome for Windows. It allows a local attacker to inject a malicious file that can be executed with elevated privileges. Because the flaw occurs in system‑level code, a corrupted reference allows privileged actions that bypass normal access controls, potentially exposing sensitive user data or allowing further exploitation of the machine.

Google Chrome on Windows versions prior to 149.0.7827.53 are susceptible. The flaw exists in the Updater component that runs during the normal installation and update process.

Chromium rates the severity as Medium. No CVSS score is published, and the EPSS score is unavailable. The vulnerability requires local access; an attacker must be on the target system or have logged‑in privileges to place the malicious file. It is not listed in CISA’s KEV catalogue, suggesting no confirmed widespread exploitation yet.