A use‑after‑free vulnerability in the DevTools front‑end of Google Chrome allows a remote attacker to execute arbitrary code inside the browser’s sandbox when a malicious HTML page is loaded. The flaw arises after DevTools frees an object that is still in use, enabling tampered memory and code execution. While Chromium rates it as medium severity, the potential for full control within the browser process represents a serious threat.

The issue affects all versions of Google Chrome earlier than 151.0.7922.72 on every platform that ships the Chromium code base, including Windows, macOS, Linux and Chrome OS. The vulnerability is confined to the browser itself and requires that DevTools be open when the attacker’s malicious content is viewed.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of <1% indicates a very low likelihood of active exploitation, and the flaw is not listed in CISA’s KEV catalog. An attacker must lure a user to open a specially crafted page while DevTools is active, which provides a path to run code within the sandbox. While the flaw does not immediately escape the sandbox, compromise of the browser process could lead to wider system compromise.