A use‑after‑free flaw in the Chromoting component of Google Chrome on Windows permits a local attacker to invoke code execution with elevated privileges through a malicious file. The bug allows the attacker to abuse freed memory, potentially overriding function pointers or control flow to run arbitrary OS‑level code, which can lead to full system compromise if the user has higher privileges than the attacker. This use‑after‑free flaw is classified as CWE-416, and the associated improper memory handling is identified as CWE-825.

Google Chrome versions on Windows released before build 149.0.7827.155 are affected. Users running these builds on any Windows operating system are at risk until they install the updated Chrome rev.

The CVSS v3.1 score of 7.8 reflects the high impact of privilege escalation possible with local execution, yet the EPSS rate of less than 1% indicates that real‑world exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits. Attackers would need local access and to launch a crafted malicious file that Chrome processes, implying an insider or compromised user session. Until the update is applied, the risk remains medium to high for environments where users may open untrusted files from unverified sources.