This vulnerability is a use‑after‑free in Chromium's Skia graphics library. The flaw allows a remote attacker who can already compromise the process to potentially escape the browser sandbox and execute code with the privileges of the host system. The flaw arises from an object being freed while still referenced, enabling the attacker to manipulate memory and trigger arbitrary execution. The attacker would need to deliver a crafted HTML page that leads the compromised renderer to access freed memory. By controlling this memory, the attacker can trigger a sandbox escape, which may then allow higher‑privilege execution or lateral movement within the machine. The impact includes confidentiality, integrity, and availability damage if the attacker succeeds. The vulnerability has a CVSS score of 8.3, an EPSS of less than 1% and is not listed in the CISA KEV catalog. Its severity is classified as Critical by Chromium. Unable to determine if remote code execution is guaranteed; the likelihood of exploitation is low but the consequence is high.

Google Chrome desktop browsers running any version prior to 151.0.7922.72 are affected. The issue was fixed in Chrome 151.0.7922.72.

The exploit requires that the attacker first compromise the renderer process, which may involve delivering malicious web content. Once compromised, the use‑after‑free can be used to escape the sandbox. While the EPSS score is low, the high impact and critical severity mean that any successful exploitation would be devastating. The CVE is not currently listed in the CISA KEV catalog, but the lack of exploitation reports does not reduce the need for prompt patching.