A use‑after‑free flaw in the WebRTC component of Google Chrome on Linux permits a remote attacker to send a specially crafted HTML page that could trigger an attempt to escape Chrome's sandbox. Based on the description, it is inferred that the flaw exposes a dangling pointer after the WebRTC object has been freed, which an attacker might exploit to execute code with higher privileges, potentially compromising system confidentiality, integrity, and availability. This weakness is classified as CWE‑416 and CWE‑825.

The vulnerability affects Google Chrome for Linux installations that are older than version 148.0.7778.216. Only the WebRTC subsystem in these historic builds is impacted; later releases contain the fix.

The Chrome security team has rated the severity as High. The CVSS score is 8.3, and the EPSS score of <1% indicates a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and requires the victim to open or view a malicious HTML page. If successfully exploited, the sandbox could be bypassed, allowing execution of arbitrary code with the rights of the Chrome process.