A use‑after‑free vulnerability (CWE‑416) exists in the Chromoting component of Google Chrome on ChromeOS, enabling a remote attacker to execute arbitrary code through malicious network traffic. This flaw permits arbitrary code execution, highlighting its critical nature as flagged by Chromium's security team.

Google Chrome on ChromeOS versions older than 150.0.7871.47 are impacted. The vulnerability affects any device where the Chromoting feature for remote desktop or similar services is enabled, including all ChromeOS devices running those Chrome releases.

Chromium rates this vulnerability as critical, with a CVSS score of 8.1 indicating severe risk. The EPSS score is less than 1%, suggesting a low probability of exploitation under current conditions. Despite this low exploitation likelihood, the remote execution vector and high CVSS score mean the flaw remains significant, especially for environments exposing Chromoting to untrusted networks. The flaw is not listed in CISA’s KEV catalog; however, for organizations that expose Chromoting, the risk persists until the patch is applied. Potential exploitation involves manipulating crafted network traffic to trigger the use‑after‑free in the Chromoting service.