A use‑after‑free flaw in Chrome’s Chromoting component on Linux allows a remote attacker to gain arbitrary code execution by sending crafted network traffic to the browser. The vulnerability is rated critical and can compromise a system with little user interaction. The flaw stems from improperly freed memory being re‑used during network parsing, resulting in uncontrolled code execution.

Affected systems are users of Google Chrome on Linux with version numbers earlier than 148.0.7778.96. This includes all stable channel releases before the listed patch. The flaw resides in the browser’s remote desktop capability.

The vulnerability permits remote code execution with a network‑based attack vector, inferred from the description that malicious traffic triggers the flaw. The CVSS score of 8.8 confirms a critical severity, and the EPSS score is not available; the issue is not listed in CISA KEV. Exploitation requires network reachability to the Chrome process and the presence of the vulnerable Chromoting feature. No publicly known exploits are reported, but the high severity coupled with the remote nature warrants immediate attention.