The flaw is a use‑after‑free in the Chrome Updater component on Windows versions prior to 150.0.7871.47. An attacker must first compromise the renderer process and serve a carefully constructed HTML page that triggers a freed memory access. This can allow the renderer to escape its sandbox and execute code with higher privileges, representing a classic CWE‑416 scenario. Chromium reviewers have rated the issue as low severity, but the potential for privilege escalation makes it a serious concern for affected users.

Google produces Chrome for desktop Windows. All installations earlier than version 150.0.7871.47 are affected. The fix is available in 150.0.7871.47 and later releases, and older versions can be upgraded to obtain the patch.

The EPSS score for this issue is less than 1%, indicating a very low probability of exploitation. The CVSS score for this vulnerability is 9.6, reflecting a highly severe risk. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread attacks. Exploitation requires having control of the renderer process and serving a malicious HTML payload to trigger the use‑after‑free. This limited attack surface reduces risk, yet the possibility of sandbox escape remains a moderate threat to users running unpatched Chrome, so updating remains advisory.