A use‑after‑free flaw exists in the Media component of Google Chrome. By serving a specially crafted HTML document, an attacker can trigger the vulnerability and execute arbitrary code inside the browser’s sandbox. The weakness corresponds to CWE‑416 and permits the attacker to compromise confidentiality, integrity, and availability of the infected machine.

All desktop installations of Google Chrome prior to version 147.0.7727.55 are affected. The issue applies across operating systems that run the Chrome browser.

The vulnerability carries a medium severity rating. No EPSS score is available and it has not been listed in the CISA KEV catalog. Exploitation requires that a victim open or load a malicious HTML page in an affected Chrome instance; the attacker does not need elevated privileges or additional footholds. Given its nature, the risk is significant for users who visit untrusted web content.