This vulnerability is a use‑after‑free condition within the WebMCP component of Google Chrome. A malicious web page can trigger a heap corruption, which may allow the attacker to execute arbitrary code or crash the browser. The weakness is classified as CWE‑416 and is positioned as a high‑severity issue. The impact would cover confidentiality and integrity of data accessed by the browser and could elevate local processes to higher privileges if the attacker gains control of the heap.

Google:Chrome versions earlier than 146.0.7680.71 are affected by this use‑after‑free flaw. The vulnerability is present on all operating systems supported by Chrome, including macOS, Linux, and Windows, as indicated by the associated CPE entries.

The CVSS score of 8.8 marks this flaw as a high‑risk vulnerability. The EPSS score is reported as less than 1%, suggesting that current exploit activity is low but not nonexistent. The vulnerability is not listed in the CISA KEV catalog, indicating that no public exploits have been documented yet. The attack vector appears to be a remote crafted HTML page loaded in the browser, meaning that any user visiting a malicious site could be at risk. The exploitation requires no special user interaction beyond rendering the page, making it a straightforward remote attack scenario.