The vulnerability is a use‑after‑free bug in Chrome’s Media code, permitting a remote attacker to cause arbitrary code execution inside a sandboxed browser context through a crafted HTML page. The flaw involves freeing a resource that is later accessed again, leading to memory corruption. This can compromise the confidentiality, integrity, and availability of the user’s device if the attacker’s code runs with the privileges of the sandboxed process.

Google Chrome users running any version of the stable channel older than 148.0.7778.168 are impacted.

The vulnerability has a CVSS score of 8.8, indicating high severity according to Chromium’s security team. Although EPSS information is not available and the issue is not listed in the KEV catalog, the lack of exploitation data does not diminish the potential damage if an attacker supplies a malicious page. The attack vector is inferred to be a crafted HTML document accessed over the normal HTTPS or HTTP traffic. Successful exploitation would allow the attacker to inject code that runs in the browser’s sandboxed environment, potentially escalating privileges or exfiltrating data if combined with other weaknesses.