Google Chrome’s Chromoting component on Linux contains a use‑after‑free flaw that permits an attacker to execute arbitrary code by sending crafted network traffic, as identified by CWE‑416. The vulnerability arises from improper memory handling after an object is freed, enabling malicious control over execution flow once the component processes the traffic. This flaw allows a remote adversary to run code with the privileges of the Chrome process, potentially compromising the entire system.

Users running Google Chrome on Linux with a version earlier than 150.0.7871.47 are affected. The flaw resides in the Chromoting component, which powers Chrome Remote Desktop functionality.

The CVSS score of 9.8 signals high severity, but the EPSS score of < 1% indicates that exploitation is currently unlikely. The flaw is not listed in the CISA KEV catalog, suggesting no widespread public exploitation yet. Attackers likely use crafted network traffic that masquerades as legitimate remote‑desktop data, indicating a remote network‑based exploitation that requires no local user interaction.