A use‑after‑free flaw in the codecs component of Google Chrome on Windows allows an attacker who has already compromised a renderer process to execute code outside the sandbox, potentially leading to full system compromise. This vulnerability is classed as high severity and is identified as CWE‑416, a classic use‑after‑free weakness that destroys memory safety guarantees.

The flaw affects Google Chrome for Windows in builds prior to version 149.0.7827.103. Any Windows installation of Chrome older than that release is potentially susceptible, especially when browsing untrusted content that may exploit the codec path.

The attack vector is most likely a crafted HTML page served from a malicious or compromised site, which an attacker can host locally or through social engineering. Even though the EPSS score is not available and the vulnerability is not listed in CISA KEV, the CVSS score of 8.3 indicates high severity, and the ability to escape the sandbox makes exploitation a serious risk. Successful exploitation would grant the attacker full control over the victim’s machine, bypassing Chrome’s sandbox restrictions.