A use‑after‑free flaw in the Cast component of Google Chrome, present in all releases before 150.0.7871.47, can be triggered by a crafted HTML page once an attacker has already compromised the renderer process. The flaw allows the attacker to escape the browser's sandbox and execute code with privileges that exceed the sandbox boundaries, potentially leading to local privilege escalation within the Chrome environment and a risk of affecting the host system. The vulnerability is a classic memory corruption weakness, identified as CWE‑416, and while the CVSS score of 9.6 indicates a high potential impact, Chromium's internal severity assessment labels it as low.

All installations of Google Chrome running a version prior to 150.0.7871.47 are affected. The Cast feature—responsible for screen sharing and media casting—is included in these builds, meaning any Chrome configuration that supports Cast is potentially vulnerable.

The EPSS score of less than 1% indicates a low likelihood of real-world exploitation. No public exploits have been reported and the vulnerability is not listed in the CISA KEV catalog. The threat is significant only when an attacker can first compromise the renderer process; otherwise, risk is limited to compromised browsing sessions. While the CVSS score of 9.6 highlights a high potential impact, Chromium's internal assessment labels the vulnerability as low.