A use‑after‑free flaw in Chrome’s updater component on Windows can be triggered by a malicious file, allowing a local attacker to escape the browser sandbox and gain OS‑level privileges, which enables arbitrary code execution with full system rights. The vulnerability is classified as CWE‑416 and is considered high severity.

Google Chrome versions prior to 150.0.7871.47 on Windows are affected. The flaw resides in the updater component that runs with elevated privileges on that platform.

The CVSS score is not published and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. An attacker needs local access to supply a crafted file that causes the updater to dereference freed memory. Successful exploitation results in complete system compromise, but the lack of EPSS or KEV data makes exploitation frequency uncertain. Given the high severity and local nature, patching is critical.