Based on the CVE description, this vulnerability is a use‑after‑free condition in Chrome’s input handling that allows a remote attacker to execute arbitrary code inside the browser’s sandbox via a crafted HTML page. The flaw is a classic use‑after‑free weakness (CWE‑416) combined with a memory‑allocation error (CWE‑825). An attacker can serve a malicious page that triggers the fault, leading the sandboxed process to run code with the same privileges as the browser.

Based on the CVE description, affected software includes Google Chrome on all platforms for versions earlier than 151.0.7922.72. The issue is present in stable channel releases before that build and was resolved in the release noted in the Chrome security notes. Devices running any of those older versions are susceptible to exploitation by an attacker who can deliver a malicious HTML page.

Based on the CVE description and available metrics, the CVSS score of 8.8 classifies the flaw as high severity. The EPSS score of less than 1 % indicates that exploitation is currently rare, and the vulnerability has not been reported in the CISA KEV catalog. Nonetheless, a remote attacker who can serve crafted HTML to a user can trigger the use‑after‑free and gain code execution inside a sandbox. The attack requires only that the user open an infected page, meaning that the exploit path is straightforward and does not need privileged access to the system.