A use‑after‑free flaw in Chrome’s Input handling, present before version 151.0.7922.72, permits a remote attacker who has already compromised the renderer process to trigger a sandbox escape through a crafted HTML page. If successfully exploited, the attacker can execute arbitrary code outside the browser sandbox, compromising the host system.

Google Chrome browsers running versions earlier than 151.0.7922.72 are vulnerable. The flaw is specific to the stable channel releases on desktop platforms.

The CVSS score of 9.6 classifies this as critical, while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to first gain control over a renderer process—typically via a separate vulnerability or social engineering—to abuse this flaw. Once in a renderer, a crafted page could break out of the sandbox, yielding full code execution on the affected system.