Technical impact
Chrome browsers running a version prior to 148.0.7778.96 contain a use‑after‑free flaw in the WebRTC component. When a specially crafted HTML page is opened, the flaw can be triggered to run arbitrary code within Chrome’s sandbox, giving the attacker the same permissions as the sandboxed process. This flaw is a classic use‑after‑free (CWE‑416) and a memory corruption issue (CWE‑825) that can lead to remote code execution from outside the browser.
Affected Systems
All users of Google Chrome on desktop platforms that have not upgraded to version 148.0.7778.96 or newer are potentially affected. The vulnerability specifically impacts Chrome’s WebRTC implementation used for real‑time communication in web applications.
Risk and Exploitability
The EPSS score of 0.00113 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The flaw permits remote exploitation through a single HTML page. Because the exploit operates inside the sandbox, privilege escalation is limited, but the ability to run arbitrary code can compromise the host if a sandbox escape exists or by allowing malware to later infect the system. Users should treat this as a moderate‑to‑high risk until the browser is updated.
Debian DSA