A use‑after‑free flaw in Chrome’s media subsystem allows a remote attacker to execute arbitrary code within the browser’s sandbox via a specially crafted HTML page. The vulnerability can be exploited to run code inside the sandboxed environment.

All installations of Google Chrome versions earlier than 147.0.7727.138 are affected. The issue is limited to the media handling components and does not require elevated privileges beyond the normal browser user context.

The flaw carries a CVSS score of 8.8, indicating high severity, and facilitates code execution within a sandboxed environment. An EPSS score of 0.00038 (below 1%) indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation likely requires the user to load a malicious webpage, making social engineering a prerequisite. Given the lack of public exploitation evidence and the absence of a KEV listing, the immediate risk remains moderate to high for actively browsing users.