The vulnerability results from an inappropriate implementation within the Frame component of Google Chrome. It allows a remote attacker to trigger an out-of-bounds memory access by delivering a specially crafted HTML page. The resulting memory access could lead to memory corruption.

Google Chrome browsers running any version prior to 151.0.7922.72. This includes stable channel releases before that version, which may still be in use on older machines or devices that have not received the latest update.

The CVSS score of 8.8 denotes high severity, while the EPSS score of less than 1% indicates a low likelihood of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote web page that the victim accesses; the flaw is triggered by a crafted HTML file. No publicly available exploitation code is documented, so the risk remains theoretical, but the combination of high severity and potential memory corruption warrants prompt remediation.