The vulnerability is a use‑after‑free in the Translate component of Google Chrome. When an attacker serves a specially crafted HTML page, the browser may access memory that has already been freed, allowing the attacker to execute arbitrary code that runs inside Chrome’s content sandbox. This weakness is identified as CWE‑416 and is also related to CWE‑825, which covers data corruption and unintended behavior arising from such memory misuse. The chromium security severity is High, and the flaw could compromise confidentiality, integrity, and availability of the system.

Google Chrome is affected on all releases prior to 151.0.7922.109. Versions 151.0.7922.109 and later contain the fix, so any user who has not updated to at least this version is at risk.

The CVSS score is 8.8, indicating a high severity, but the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalogue, indicating no confirmed widespread exploitation. The attack requires an external user to load a malicious page in Chrome and relies on the use‑after‑free bug. Because the code executes inside a sandbox, it does not immediately escape to the host system, yet it remains a severe risk until a fix is applied.