A use‑after‑free flaw in the Chromoting component of Google Chrome on Windows allows a remote attacker to execute arbitrary code via malicious network traffic. The vulnerability is classified as a Critical severity. An attacker who can inject crafted packets into the Chrome process can trigger the exploit, resulting in full compromise of the victim’s system.

Google Chrome for Windows versions earlier than 150.0.7871.47 are affected. Systems running these versions without the latest update remain vulnerable.

The bug is remotely exploitable and is vulnerable to traffic that reaches Chrome’s Chromoting module. The EPSS score of <1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 8.1 reflects high severity, meaning full system compromise is possible if exploited. Based on the description, it is inferred that the attack likely requires network access to the target machine and the ability to send specially crafted packets to the Chrome process through the Chromoting port. Given the low EPSS, organizations may consider monitoring or disabling Chromoting as an additional mitigative measure.