A use‑after‑free flaw in Chrome’s Views component allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox and execute code outside the renderer’s confined environment. The weakness is classified as CWE‑416 and can lead to arbitrary code execution and privilege escalation on the host system.

Google Chrome releases prior to version 151.0.7922.72 on any operating system are vulnerable. Users and systems that have not installed this update are at risk, especially if they run applications that rely on Chrome’s rendering engine.

The CVSS score of 9.6 indicates a high severity vulnerability, yet the EPSS score of less than 1% shows that exploitation probability is currently minimal and no active exploits have been reported. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to first gain control of the renderer process, which is typically achieved through malicious web content or other means that bypass normal sandbox restrictions. Once the renderer is compromised, the use‑after‑free can be leveraged to escape the sandbox and run code with elevated privileges.