A use‑after‑free flaw in Chrome’s Oilpan rendering engine permits a remote attacker to run arbitrary code inside the browser’s sandbox when a specially crafted HTML page is loaded. The vulnerability, classified as CWE‑416, is rated medium severity by Chromium and could allow an attacker to compromise processes running within the sandbox, potentially serving as a stepping‑stone to broader compromise if additional sandbox escape paths exist.

Google Chrome desktop editions on any operating system that were released before version 150.0.7871.47 are affected. This includes all standard builds of Chrome for Windows, macOS, and Linux that have not yet been updated to the 150.0.7871.47 release or later.

The flaw can be exploited by delivering a crafted HTML page to a user who opens it in Chrome without any authentication. The attack vector is inferred to be remote web content, as the vulnerability is triggered by content loaded into the browser. Because the exploitation remains confined to the sandbox, the practical impact is limited to sandboxed processes, but the medium severity rating and lack of a reported KEV listing suggest the risk is moderate. No EPSS score is available, and the CVSS score is not provided.