The flaw is a use‑after‑free in Chrome’s media handling code. After the renderer process has already been compromised, a crafted HTML page can trigger a freed memory region to be reused, potentially breaking the browser sandbox isolation. This would allow attacker supplied code to run with higher privileges, endangering confidentiality, integrity, and availability of the host system. The Chromium team rates this Medium severity, but the CVSS score of 9.6 indicates a very high impact.

Google Chrome browsers older than version 151.0.7922.72 are affected. The issue is triggered only when the renderer process is already compromised during page rendering.

The CVSS score of 9.6 shows a very high severity, while the EPSS score of less than 1% indicates a low overall probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to provide a crafted HTML page that targets a renderer that has already been compromised; after exploitation the sandbox could be escaped, giving the attacker the ability to execute arbitrary code.