A use‑after‑free flaw exists in Chrome’s media component that allows a remote attacker to trigger arbitrary code execution inside the browser’s sandbox by loading a crafted HTML page. The vulnerability occurs when media objects are freed while still referenced, enabling the attacker to manipulate memory and execute code within the sandboxed environment. The weakness is classified as CWE‑416 and is considered a high‑severity issue.

The flaw affects Google Chrome versions older than 147.0.7727.55. Any user running a pre‑147.0.7727.55 build is vulnerable and should upgrade to the latest release to mitigate the risk.

The CVSS score of 8.8 reflects significant impact, while the EPSS score of less than 1% indicates that exploitation is currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, relying on a malicious HTML page that can be served by any web host, and requires the victim to load the page in Chrome. Successful exploitation allows execution of code within Chrome’s sandbox, presenting a serious threat to the user’s computing environment.