The vulnerability is a use‑after‑free in the WebRTC engine of Google Chrome; when a maliciously crafted HTML page is loaded, the bug can corrupt the heap, potentially allowing the attacker to execute arbitrary code on the victim’s system. This results in loss of confidentiality, integrity, and availability for the affected user. The flaw is identified as CWE‑416 and is rated high severity by Chromium.

This flaw affects all installations of Google Chrome that are before version 146.0.7680.153. The vulnerability is present in the Chrome binary shipped for Windows, macOS, and Linux, so any user running an outdated Chrome browser on these operating systems is potentially compromised.

The CVSS score is 8.8, indicating high severity, while the EPSS probability is less than 1 percent, suggesting that exploitation is currently unlikely to be widespread. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to lure a user to a malicious web page that contains specially crafted WebRTC content; once the page is rendered, the use‑after‑free can be triggered to achieve code execution. No privileged status is required, making the vulnerability exploitable in the user context.