A use‑after‑free bug exists in the media codec component of Google Chrome before version 147.0.7727.138. When a crafted HTML page is rendered, the bug causes a memory region that has already been freed to be accessed again, enabling an attacker to run code inside the browser’s sandboxed renderer process. The vulnerability allows the execution of arbitrary code, presenting a high‑severity risk for affected browsers. It is identified as CWE‑416 (Use‑After‑Free) and CWE‑825 (Memory Corruption), and carries a CVSS score of 8.8.

The flaw affects all Google Chrome installations on supported platforms—desktop, mobile, and web—where the version is older than 147.0.7727.138. Any stable channel build of Chrome that predates this release is vulnerable.

The issue is rated as high severity by Chromium security. An attacker who can supply a tailored web page can trigger the use‑after‑free from any remote location without the need for local credentials. The EPSS score of < 1% indicates that the probability of exploitation is low but not zero, and the vulnerability is not listed in the CISA KEV catalog. The attacker can execute arbitrary sandboxed code, which could be used for further attacks from within the confined renderer process. The CVSS score of 8.8 confirms a high‑severity risk.