A use‑after‑free condition exists in the ANGLE graphics component of Google Chrome on Windows when the browser version is older than 151.0.7922.72. The flaw can be triggered by a crafted HTML page served to the victim and may enable a sandbox escape, thereby allowing an attacker to lift the browser’s security restrictions and execute code with elevated privileges. The weakness is listed as CWE‑416, indicating a classic memory‑management problem. The vulnerability is rated Medium by Chromium security, and it specifically targets client‑side rendering of web content.

The impact is limited to Microsoft Windows systems running Google Chrome v151.0.7922.71 or earlier. Only the stable channel of Chrome is mentioned in the advisories, but any affected build that incorporates the vulnerable ANGLE code falls under this scope. Users of experimental or beta builds that match these version constraints are also exposed.

The exploit probability is very low, with an EPSS score of less than 1%, and the flaw is not listed in the CISA KEV catalog, indicating limited known or documented exploitation. The attack vector requires a remote attacker to supply a malicious HTML page that the victim must load, usually by tricking the user into visiting a compromised site or link. Once the page loads, the use‑after‑free can trigger a sandbox escape if the attacker supplies sufficient crafted content. The CVSS score of 7.1 indicates medium severity, and the nature of the flaw suggests that a successful exploit could result in significant impact on the user’s system.