A use‑after‑free bug in the Cast component of Google Chrome allows an attacker on the same local network to send crafted Cast traffic that causes heap corruption. This flaw, identified as CWE‑416, can be leveraged to achieve arbitrary code execution or denial of service. The severity is marked high by Chromium, highlighting the risk.

Google Chrome browsers, versions before 147.0.7727.138, on the stable channel desktop releases are affected.

Chromium rates this vulnerability as high. No EPSS score is available and it is not listed in CISA KEV. Exploit requires local‑network proximity to send malicious Cast traffic, but the lack of publicly known exploits suggests a dependency on the attacker’s network position. Nonetheless, arbitrary code execution remains a serious threat, so patching should be prioritized.