A use‑after‑free vulnerability in the tracing subsystem of Google Chrome (CWE‑416) allows a local attacker to exploit a malicious file and gain elevated privileges on a Windows machine. The flaw, also described as an Access Control Weakness (CWE‑825), can be triggered without requiring network access and enables the attacker to write arbitrary data after a freed object, potentially leading to arbitrary code execution at the operating system level.

Google Chrome on Windows versions prior to 151.0.7922.72 is affected. The vulnerability applies to all installations of that browser running on the Windows operating system where the vulnerable tracing feature is enabled.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% shows low expected exploitation probability at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires local access and a crafted malicious file, which can be placed in a location accessible to the user to trigger the use‑after‑free during tracing operations.