A use‑after‑free flaw in the V8 JavaScript engine of Google Chrome allows a remote attacker who has already compromised the renderer process to trigger out‑of‑bounds memory access via a specially crafted HTML page. This memory corruption could be leveraged to execute arbitrary code or otherwise undermine the integrity of the system.

All installations of Google Chrome with a version prior to 151.0.7922.72 are affected, as the renderer process in those builds contains the vulnerable V8 code.

The CVSS score of 8.8 indicates a high severity, while the current EPSS score of less than 1% suggests a low overall likelihood of widespread exploitation. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an attacker to gain control of a renderer process—typically through a malicious web page—before the crafted HTML triggers the use‑after‑free, after which an attacker could gain remote code execution capabilities.