A use‑after‑free bug in the WebGL implementation of Google Chrome on Android, discovered before version 151.0.7922.109, enables a malicious site that can abuse a compromised renderer process to potentially escape the browser sandbox and gain broader system privileges. The weakness involves a use‑after‑free (CWE‑416) and an improper memory handling condition (CWE‑825) that can be triggered by a crafted HTML page, allowing remote code execution if the attacker controls the renderer. The damage would include accessing sensitive local data and performing actions on the device with elevated privileges.

Affected systems are Android devices running Google Chrome browsers older than 151.0.7922.109. No specific sub‑version details were supplied beyond the general pre‑151.0.7922.109 cutoff. Any device with this legacy browser version remains at risk.

The CVSS score of 8.3 indicates high severity. The reported severity is classified as critical by Chromium security. This vulnerability combines a use‑after‑free (CWE‑416) with an improper memory handling condition (CWE‑825), leading to a sandbox escape. The EPSS score of <1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The nature of the flaw—remote control of the renderer process leading to sandbox escape—implies a high exploitation potential for an attacker capable of serving malicious content. The likely attack vector is a compromised renderer process accessed via a maliciously crafted HTML page delivered from an attacker‑controlled site.