The vulnerability is a use‑after‑free flaw (CWE-416) in the Cast Receiver component of Google Chrome. When a specially crafted HTML page is loaded, the renderer can free memory that is still in use and then reuse that memory, which lets an attacker run arbitrary code inside a sandboxed rendering process. The ability to execute arbitrary code within the sandbox can allow malware installation or other malicious activity confined to that process.

This issue affects all installations of Google Chrome prior to version 150.0.7871.47 that have the Cast Receiver feature enabled. Any user or system running a vulnerable Chrome build with casting enabled is at risk.

The EPSS score of < 1 % indicates a low likelihood of exploitation. The CVSS score of 8.8 classifies the flaw as high severity, meaning that if it is successfully exploited the attacker could achieve arbitrary code execution in the sandboxed process. The vulnerability is not listed in CISA KEV, suggesting no widespread exploitation has been observed. The attack vector is remote: a malicious web page that triggers the Cast Receiver can exploit the use‑after‑free.