A use‑after‑free flaw in the codecs component of Google Chrome on Windows allows an attacker who has already compromised a renderer process to execute code outside the sandbox, potentially leading to full system compromise. This vulnerability is classed as CWE‑416 and CWE‑825, indicating a classic use‑after‑free weakness combined with improper use of uninitialized or unsafe memory, both of which destroy memory safety guarantees.

The flaw affects Google Chrome for Windows in builds prior to version 149.0.7827.103. Any Windows installation of Chrome older than that release is potentially susceptible, especially when browsing untrusted content that may exploit the codec path.

The attack vector is most likely a crafted HTML page served from a malicious or compromised site, which an attacker can host locally or through social engineering. The EPSS score of 0.00068 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, but the CVSS score of 8.3 indicates high severity, and the ability to escape the sandbox makes exploitation a serious risk. Successful exploitation would grant the attacker full control over the victim’s machine, bypassing Chrome’s sandbox restrictions.