A use‑after‑free flaw exists in the Chromoting component of Google Chrome on Linux before version 150.0. crafted network traffic that targets the Chromoting service, an attacker can trigger access to freed memory, leading to arbitrary code execution. The weakness is identified as CWE‑416, indicating improper handling of memory after deallocation, and grants the attacker full control over the compromised host.

Google Chrome installations on Linux distributions using any version prior to 150.0.7871.47 are impacted. The flaw is specific to the Chromoting protocol support in these builds, and only Linux configurations of Chrome are affected.

The CVSS score is 8.8, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits have been observed. The likely attack vector is remote network traffic that engages Chrome’s Chromoting service; an attacker must be able to send crafted packets to the target host for successful exploitation.