The vulnerability is a use‑after‑free flaw in the Loader component of Google Chrome that enables a remote attacker to craft a malicious HTML page. When this page is rendered, the browser may execute arbitrary code while still inside the sandbox. The flaw is classified as CWE‑416 and can also lead to memory corruption (CWE‑825). The impact is loss of sandbox confinement, which could allow further compromise of the host system or data exfiltration.

Device installations of Google Chrome older than version 151.0.7922.72 are affected. The bug resides in the core HTML rendering engine and applies to all platforms where Chrome is installed.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is a malicious web page that the victim visits, triggering the use‑after‑free during page rendering. Successful exploitation would allow execution of code within the browser’s sandbox, potentially enabling further compromise from that restricted context.