The flaw is a use‑after‑free in the password management component of Google Chrome that can be triggered by a crafted HTML page loaded in the browser. When activated it corrupts heap memory, which may lead to data corruption or potentially allow an attacker to gain further control. The vulnerability is classified as CWE‑416. The description does not claim that remote code execution is guaranteed, only that heap corruption is possible.

All installations of Google Chrome earlier than version 150.0.7871.47 on any operating system are affected. The vendor, Google, listed the impact across all browsers, but the specific platforms are not enumerated. Therefore, any user running a vulnerable Chrome instance should consider itself at risk until the approved update is installed.

The CVSS score of 8.8 indicates a high severity impact, yet the EPSS score of less than 1% reflects a current low probability of exploitation. The vulnerability is not in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves delivering a malicious HTML page to a victim’s browser, which would trigger the heap corruption when the Passwords component processes the page. No immediate exploit code has been disclosed, so the threat currently remains theoretical but should be treated seriously.