A use‑after‑free flaw exists in Chrome’s TabStrip component before 151.0.7922.72. By presenting a specially crafted HTML page that prompts a user to perform certain mouse gestures, an attacker may trigger heap corruption. The CVE description notes only a potential exploitation of heap corruption, not a confirmed remote code execution path.

Users of Google Chrome running any version earlier than 151.0.7922.72 are affected, regardless of operating system or platform. Updating to the 151.0.7922.72 release or newer removes the flaw.

The CVSS score of 7.5 reflects a moderate to high risk, while the EPSS score of less than 1% indicates that exploitation in the wild is currently unlikely. The attack requires a malicious web page and specific user interaction, so the vector is remote but interactive. Because the vulnerability is not listed in CISA KEV and existing controls such as safe browsing could mitigate it, the primary countermeasure remains to update the browser.