A use‑after‑free bug in Google Chrome’s WebRTC component allows a maliciously crafted HTML page to execute arbitrary code inside the browser’s sandbox. The vulnerability exists only in versions prior to 147.0.7727.55 and does not require any additional privileges; it can be triggered by loading the malicious content. The attacker thereby gains the ability to manipulate data or processes within the sandbox, which can lead to privilege escalation or further exploitation if the sandbox can escape.

The flaw affects all installations of Google Chrome older than 147.0.7727.55 on Windows, macOS, and Linux. Any user who loads a malicious page in a vulnerable version is at risk, regardless of the operating system. The issue is independent of whether a user is on a personal or corporate machine.

The CVSS score of 8.8 denotes high severity, and the EPSS score of less than 1% indicates that exploitation is not common but still possible. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is the delivery of the crafted HTML page, which could be obtained through a phishing link, malicious advertisement, or compromised website. Protection against such vectors requires up‑to‑date software and cautious browsing habits.