This vulnerability is a use‑after‑free flaw in the WebRTC component of Google Chrome. When a specially crafted HTML document is displayed in Chrome on Linux, the browser can access memory that has already been freed, allowing the attacker to run arbitrary code within the browser process. The flaw permits full compromise of confidentiality, integrity, and availability for the affected user, granting an attacker the ability to execute any code with the privileges of the browser, potentially leading to system‑wide compromise. It is classified as CWE‑416.

Google Chrome on Linux versions prior to 148.0.7778.179 are affected. No other vendors or product lines were listed. The flaw is exploitable via a crafted web page loaded in the affected Chrome binaries.

The CVSS score is 8.8. The EPSS score is not available, but the flaw is marked as critical. It is not listed in the CISA KEV catalog. The attack vector is remote, requiring an attacker to serve a malicious HTML page. No authentication or privileged access is needed beyond a user visiting the page. Once triggered, the use‑after‑free can lead to arbitrary code execution, making the risk and potential impact high for users of the affected Chrome versions.