A use‑after‑free flaw in Chrome’s Oilpan rendering engine allows a remote attacker to execute arbitrary code inside a sandboxed browser process by loading a specially crafted HTML page. The vulnerability is identified as CWE‑416 and is rated high severity by the CVSS of 8.8, indicating that exploitation could lead to compromise of the sandboxed renderer. Because the flaw is confined to the sandboxed process, the attacker cannot directly access the underlying operating system, but malware can be executed within the compromised context.

Google Chrome versions before 150.0.7871.47 are affected. The data does not specify operating systems, so the vulnerability may affect any platform that runs a vulnerable Chrome version.

Exploitation requires only the delivery of a malicious HTML page that Chrome renders. The one‑shot use‑after‑free triggers when the crafted content is parsed inside the sandboxed renderer. The CVSS score 8.8 indicates high severity. The EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis, but the high CVSS makes it a concern. The vulnerability is not tracked in CISA’s KEV catalog.