A use-after-free flaw in Google Chrome’s WebRTC component allows a remote attacker to run arbitrary code inside the browser’s sandbox when a victim opens a specially crafted HTML page. Due to improper memory handling, the attacker can abuse the freed object to execute malicious instructions, compromising confidentiality, integrity, and potentially enabling privilege escalation within the browser if the sandbox is broken. The vulnerability is identified as CWE-416 and carries a high severity rating from Chromium’s security team.

The flaw affects all Google Chrome releases prior to version 147.0.7727.138. Users running these earlier versions are susceptible, regardless of operating system, as the issue resides in the core WebRTC implementation bundled with the browser. Updated releases of Chrome starting with 147.0.7727.138 contain the necessary patch.

The EPSS score is not available and the vulnerability is not listed on the CISA KEV, but the high severity and the ability to trigger it via a remote HTML payload make the risk substantial. An attacker can embed malicious code in a web page that will be served to users who browse the site, executing the exploit without any interaction beyond page load. The primary attack vector is remote, through malicious or compromised websites that deliver the crafted payload to a vulnerable Chrome user.