A use‑after‑free vulnerability in the WebRTC component of Google Chrome allows a remote attacker to craft an HTML page that triggers code execution inside a sandboxed browser process. The flaw, classified as CWE‑416, occurs when the browser accesses memory after it has been freed, enabling the attacker to inject or overwrite executable payloads. Although the target process is sandboxed, a successful exploit can gain privileges beyond the sandbox, potentially compromising system confidentiality or integrity.

The defect affects all installations of Google Chrome with versions earlier than 148.0.7778.96, regardless of operating system. Users on Windows, macOS, Linux, and other supported platforms exposed to malicious web content are vulnerable.

The attacker only needs the victim to load a crafted web page; no local privileges or special network configuration are required. EPSS data is not available, and the vulnerability is not listed in CISA KEV, but the CVSS score of 8.8 indicates a serious risk. The flaw permits execution within the sandboxed browser process, which limits the impact to the data and processes that the sandbox can access. Because the attack requires no privileged user interaction and targets any user visiting malicious content, prompt remediation is advised.