Google Chrome suffered a use‑after‑free flaw in its WebRTC implementation that allowed a remote attacker to trigger arbitrary code execution inside the browser sandbox. The vulnerability is classified as CWE‑416 and carries a high severity rating by Chromium. Attackers could send a crafted HTML page to an unsuspecting user and cause the browser to execute malicious code, potentially compromising confidential data or gaining elevated privileges within the sandbox.

All versions of the Google Chrome stable channel that are older than 157.0.8103.38 are affected, regardless of operating system. The fix was released in the stable update published on November 2026 and applies to desktop installations. Users on earlier releases who have not yet updated remain vulnerable.

The vulnerability can be exploited when a user views a malicious webpage, making the attack vector remote and user‑dependent. While no EPSS data is available, the high severity rating and the nature of the flaw imply that exploitation is feasible and would be powerful. The vulnerability is not listed in the CISA KEV catalog, but the lack of an EPSS score does not reduce the need for rapid remediation.