A use‑after‑free flaw in Chrome’s DataTransfer component on Windows lets a remote attacker who has compromised the renderer process escape the browser sandbox. The bug uses memory corruption (CWE‑416) to trigger arbitrary code execution with higher privileges. If exploited, an attacker could run malicious native code on the host system.

Google Chrome for Windows versions earlier than 151.0.7922.72. The problem exists in the stable channel and affects typical desktop deployments of the browser.

The CVSS score is 9.6, classifying the vulnerability as critical. However, the EPSS score is less than 1 %, suggesting a low probability of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog. A successful exploitation requires the attacker already control the renderer process, often through a crafted HTML page delivered by a malicious website.