A use‑after‑free flaw occurs in the GetUserMedia API in Google Chrome. When a renderer process that has already been compromised processes a specially crafted HTML page, the flaw can enable the attacker to escape the sandbox and execute code with higher privileges. The vulnerability is classified as CWE‑416. The primary impact is a sandbox escape, potentially leading to system compromise if executed successfully.

Google Chrome browsers with versions prior to 150.0.7871.47 are vulnerable. All desktop installations that have not yet applied the latest update expose the renderer process to the risk. The issue applies to the stable channel and affects all supported operating systems on which Chrome runs.

The CVSS score of 9.6 indicates a high‑severity risk. An EPSS score of <1% suggests the likelihood of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires a previously compromised renderer process, which may be achieved through another vulnerability or user interaction. If the sandbox escape succeeds, the attacker could gain elevated privileges and potentially execute arbitrary code at the host level.