This vulnerability is a use‑after‑free within Chrome's WebMIDI implementation. An attacker who can compromise the renderer process – for example, by serving malicious content on a web page – can trigger a memory corruption that leads to a sandbox escape. The flaw is classified as CWE‑416, and could allow the attacker to execute arbitrary code with a higher privilege level than the browser sandbox, potentially compromising a user’s entire system.

Google Chrome versions prior to 147.0.7727.138 are affected. The vulnerability exists only in the desktop Chrome browser and is not present in earlier patched releases.

Chromium lists this incident with high severity, indicating a significant risk to both confidentiality and integrity. The EPSS score is not available, so the current exploitation probability is unknown, and the vulnerability is not included in CISA's KEV catalog. The attack vector requires a compromised renderer process, typically achieved through malicious HTML content or a crafted web page, which makes the exploit technically demanding but feasible for an attacker who can deliver code to the vulnerable browser.