Chrome’s updater contains a use‑after‑free bug that can be triggered by carefully crafted network traffic. When the update module erroneously uses freed memory, a local attacker can exercise privilege escalation, potentially running code with elevated privileges on the affected machine. The vulnerability is classified as high severity and could enable attackers to compromise system integrity if they gain local access to the user’s environment.

Google Chrome for macOS versions earlier than 151.0.7922.72. The issue specifically affects the updater component of the browser on Mac platforms, and any machine running an affected Chrome build is susceptible to local privilege escalation via malicious traffic received by the updater service.

The CVSS score of 8.4 indicates a serious risk, though the EPSS score is below 1%, suggesting a very low probability of exploitation in the wild at this time. The vulnerability is not listed in CISA KEV. A likely attack vector involves a local attacker sending crafted packets to Chrome’s updater, causing a use‑after‑free condition. Exploitation requires the attacker to be on the same machine or have network access that permits the delivery of malicious traffic to the updater service.