Google Chrome versions prior to 147.0.7727.101 contain a use‑after‑free bug in the codec handling code that allows a remote attacker to craft a video file triggering an out‑of‑bounds memory read or write. This flaw is a classic memory corruption weakness classified as CWE‑416 and also as CWE‑825. The vulnerability is described as a high‑severity issue by Chromium, indicating significant potential impact, though the description does not explicitly state that it leads to arbitrary code execution.

All installations of Google Chrome on supported operating systems are affected if the browser version is older than 147.0.7727.101. The vulnerability is not limited to a specific platform, so any user running a vulnerable release remains at risk.

An attacker can exploit the flaw by delivering a specially crafted video file to the browser, which can be done via malicious websites, email attachments, or compromised media streams. The EPSS score is < 1%, and the vulnerability is not currently listed in the CISA KEV catalog. Chromium rates the problem as high severity, with a CVSS score of 6.3, suggesting that, if the attack succeeds, the attacker may cause memory corruption and potential system compromise, depending on privileges and sandbox mitigations. The likely attack vector is remote, initiated through the client side.