A use‑after‑free bug exists in the WebRTC implementation of Google Chrome versions prior to 147.0.7727.138. When a crafted HTML page is loaded, the flaw causes the browser to access freed memory inside a sandboxed context, enabling a remote attacker to run arbitrary code with sandboxed privileges. The weakness is classified as CWE‑416 and the Chromium project rates the severity as high.

Google Chrome browsers running any version earlier than 147.0.7727.138 are affected. This includes all stable channel releases that precede the security patch supplied in April 2026.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the Chromium project has identified it as a high‑severity flaw. The likely attack vector is a malicious web page that a user visits or is prompted to open. Exploitation requires the victim to load the crafted page in a Chrome browser, after which arbitrary code can be executed inside the browser’s sandbox.