This vulnerability is a use‑after‑free flaw in the Glic component of Google Chrome that can allow an attacker who has first compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The flaw permits code paths that bypass the browser’s sandbox boundaries, enabling the attacker to gain elevated privileges relative to the renderer. The weakness is identified as CWE‑416 and is classified as high severity by Chromium, owing to the potential privilege escalation it provides. No claim is made regarding arbitrary code execution beyond this.

Users Google Chrome versions earlier than 150.0.7871.47 are affected. The problem exists in stable channel releases before that revision. Anyone who visits an infected or malicious web page in those versions is at risk until the issue is patched.

The EPSS score of less than 1% indicates a low probability that this vulnerability is being actively exploited in the wild at present. However, the CVSS score of 8.3 reflects a high severity risk if the flaw is leveraged. The vulnerability requires a prior compromise of the renderer process, such as through a separate vulnerability, before the use‑after‑free can lead to a sandbox escape. Once the renderer is compromised, an attacker can deliver a crafted HTML page that triggers the use‑after‑free in Glic, bypassing sandbox boundaries and elevating privileges. The absence of a listing in the CISA KEV catalog means no extensive, publicly documented exploitation has been reported, but the high CVSS and the need for prior renderer compromise still represent a significant security concern.