Chrome browsers running a version prior to 148.0.7778.96 contain a use‑after‑free flaw in the WebRTC component. When a specially crafted HTML page is opened, the flaw can be triggered to run arbitrary code within Chrome’s sandbox, giving the attacker the same permissions as the sandboxed process. This flaw is a classic use‑after‑free (CWE‑416) that can lead to remote code execution from outside the browser.

All users of Google Chrome on desktop platforms that have not upgraded to version 148.0.7778.96 or newer are potentially affected. The vulnerability specifically impacts Chrome’s WebRTC implementation used for real‑time communication in web applications.

Although the EPSS score is not yet available and the vulnerability is not listed in CISA’s KEV catalog, the nature of the flaw permits remote exploitation through a single HTML page. Because the exploit operates inside the sandbox, privilege escalation is limited, but the ability to run arbitrary code can compromise the host if a sandbox escape exists or by allowing malware to later infect the system. Users should treat this as a moderate‑to‑high risk until the browser is updated.