A use‑after‑free vulnerability exists in Google Chrome’s compositing code that can be triggered by a malicious HTML page. The flaw allows code execution with higher privileges once the renderer process has been compromised, potentially enabling arbitrary code execution, data exfiltration, or denial of service on the affected system.

Google Chrome stable channel versions prior to 151.0.7922.72 are affected. All users running older stable builds are potentially impacted until they update to a patched release.

The CVSS score of 8.3 classifies this as high severity, yet the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker must first compromise the renderer process; thus the attack vector involves a prior foothold in the renderer sandbox, making it more complex and less likely to occur.