A use‑after‑free flaw in the Cast component of Google Chrome allows an attacker who can send carefully crafted network traffic on the local network to cause Chrome to execute arbitrary code with the privileges of its sandbox. The vulnerability is a memory corruption error that is triggered by malicious Cast protocol data and is classified under CWE-416 and CWE-825.

The affected product is Google Chrome. Versions prior to 147.0.7727.138 on the stable channel are vulnerable. Any build of Chrome that includes the Cast protocol before this version is impacted.

Exploitation requires an adversary that can communicate on the same local network segment as the victim and can send custom Cast packets to the target machine. The victim’s browser must be running and receive the malicious traffic. The attacker gains code execution confined to the sandbox that Chrome uses, but since the sandbox restricts system access, the impact remains limited to the browser process. The EPSS score is under 1 %, the CVSS score is 7.5, and the vulnerability is not listed in the CISA KEV catalog, indicating a moderate exploitation likelihood in local‑network contexts.