Impact
Use after free in the Views component of Google Chrome can lead a local attacker to escape the browser sandbox by manipulating a malicious file. The flaw occurs when stale memory is accessed after the object has been freed, causing the browser to perform privileged operations on corrupted data. The vulnerability is classified as high severity and could allow an attacker to gain elevated privileges or execute arbitrary code outside the sandbox environment.
Affected Systems
Google Chrome versions earlier than 151.0.7922.72 on Windows, macOS, and Linux installations are affected; all platforms that run the Chrome browser fall under the risk.
Risk and Exploitability
Based on the description, it is inferred that the likely attack vector is a local attacker opening a crafted file that the Chrome renderer processes, possibly through the file system or a network service. The CVSS score of 8.6 indicates high impact, while the EPSS score of less than 1% suggests that exploitation is currently rare but still plausible. The vulnerability is not listed in CISA KEV, meaning no widely documented attacks have been seen so far. If successful, the attacker can escape the sandbox and run code with the privileges of the user.
OpenCVE Enrichment
Debian DLA
Debian DSA