Object lifecycle issue in WebView in Google Chrome on Android before version 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to use a crafted HTML page in order to potentially escape the sandbox environment. The flaw is a classic use‑after‑free and executable code injection problem (CWE‑416 and CWE‑386) and could grant an attacker code execution beyond the browser’s sandbox, compromising the integrity and confidentiality of the device and any applications that rely on the affected WebView component.

Google Chrome on Android devices whose browser version is earlier than 151.0.7922.72. The vulnerability is limited to the Chrome rendering process and the WebView component, affecting all Android installations of Chrome with those versions.

The CVSS score of 8.3 indicates high severity, but the EPSS score of less than 1 percent shows a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to first compromise the renderer process of Chrome and then serve a crafted HTML page; the attack would then achieve sandbox escape. Because the attack vector is limited to a compromised process and a specific HTML payload, the risk is high in the event it is successfully executed but the overall exposure remains moderate due to the low exploitation probability.