Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox through a crafted HTML page. This memory corruption flaw (CWE-416) could lead to the attacker running code with the browser’s sandbox privileges, potentially compromising confidential data or enabling further attacks. The vulnerability is a classic use‑after‑free that can be triggered when a user loads a malicious web page.

All users of Google Chrome versions earlier than 151.0.7922.72. The affected product is Google Chrome, identified by the vendor Google under the product Chrome.

The CVSS score of 8.8 marks the issue as high severity. However, the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low, and the vulnerability is not yet listed in the CISA KEV catalog. The attack requires a malicious site to serve a crafted HTML page; the attacker would need the user to visit that page for the use‑after‑free to trigger. Even though the code runs only inside the browser sandbox, that environment can still expose sensitive information and provide a foothold for lateral movement.