A use‑after‑free bug exists in Chrome’s Media component on Windows. When a crafted HTML page is processed, it can lead to heap corruption. The CVE notice states that a remote attacker could potentially exploit this corruption. Based on the description, this vulnerability could allow an attacker to execute arbitrary code or otherwise compromise the system, but the impact is not guaranteed. The weakness corresponds to CWE‑416, a memory use‑after‑free issue.

Google Chrome browsers on Windows prior to version 149.0.7827.115 are affected. Any installation running an older revision that has not been updated by Chrome’s automatic patch mechanism is at risk.

The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, yet the high severity rating indicates considerable potential danger. The likely attack vector is remote, via a maliciously crafted HTML page opened by a user. An attacker does not need local privileges; the exploit would require the victim to load the vulnerable page.