An incorrect scheduling implementation in Google Chrome allows a remote attacker to craft an HTML page that can execute arbitrary code inside the browser’s sandbox. The vulnerability, classified as CWE-269, gives the attacker the ability to run code with the privileges assigned to the sandboxed process, effectively compromising the execution environment.

All installations of Google Chrome prior to version 151.0.7922.72 are affected. No specific sub-version range is listed beyond this cutoff, so any build older than the mentioned one carries the flaw.

The flaw carries a CVSS score of 8.8, indicating a high severity rating. The EPSS score is below 1%, suggesting that while the vulnerability is severe, it is not widely exploited in the wild at present, and it is not listed in CISA's KEV catalog. The likely attack vector is a malicious webpage that a user opens, meaning the threat is remote but requires user interaction or a compromised site to trigger the exploit.