Google Chrome versions prior to 151.0.7922.72 contain a use‑after‑free vulnerability in the WebSocket implementation that can be triggered by a crafted HTML page. The flaw permits a sandbox escape, allowing an attacker to execute code on the client system. The issue is rooted in improper deallocation of memory buffers (CWE‑416) and could be aggravated by resource exhaustion handling (CWE‑825).

All desktop installations of Google Chrome running a version older than 151.0.7922.72 are affected. The vulnerability applies to the Chromium WebSocket stack on Windows, macOS, and Linux, but no information is available regarding mobile or other Chromium‑based browsers.

The CVSS base score of 9.6 indicates a critical vulnerability, but the EPSS score of less than 1 % suggests a very low probability of exploitation in the current threat landscape. The flaw is not listed in the CISA KEV catalog. The primary attack vector is inferred to be a malicious web page delivered over HTTP or HTTPS, which, when opened by a user or injected into an existing page, can trigger the use‑after‑free and potentially escape the sandbox. Exfiltration of code execution would likely depend on user interaction or permissive browser settings.