A use‑after‑free flaw in the V8 JavaScript engine of Google Chrome versions earlier than 151.0.7922.72 permits a remote attacker to trigger arbitrary code execution inside the browser’s sandbox by serving a specially crafted HTML page. The flaw is a classic memory corruption issue (CWE‑416) that can exploit the browser’s handling of freed memory.

Devices running the stable desktop channel of Google Chrome dated before 151.0.7922.72 are affected. The issue touches the V8 engine and therefore applies to all platforms where the desktop Chrome browser uses that engine.

The CVSS score of 8.8 classifies the vulnerability as high severity, and the EPSS score of less than 1% indicates a low probability of exploitation at the moment. Although it is not listed in the CISA KEV catalog, a successful exploit would grant the attacker remote code execution confined to the browser sandbox, which could be leveraged for more privileged attacks on the host system.