A use‑after‑free flaw in the Aura UI framework of Google Chrome on Linux allows an attacker who has compromised the renderer process to exploit freed memory and potentially overwrite critical control data. By delivering a crafted HTML page, the attacker can trigger the flaw, leading to a sandbox escape and execution of arbitrary code with higher privileges. The vulnerability is classified as high severity by Chromium, reflecting its potential to compromise confidentiality, integrity, and availability.

Google Chrome on Linux systems running versions earlier than 151.0.7922.109 is affected. The flaw resides in the Aura component of the browser; any installation of the affected Chrome release on a Linux desktop environment remains vulnerable until patched.

The CVSS score of 8.3 indicates a high severity risk. The EPSS score of less than 1% suggests that public exploitation has not been widely observed, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a compromised renderer process, which is inferred from the description; it is not directly stated in the input that this prerequisite exists. Based on the description, it is inferred that the attacker would need to gain control of the renderer process, possibly through a prior vulnerability or user interaction, before delivering the malicious HTML that triggers the use‑after‑free and out‑of‑bounds write (CWE‑416 and CWE‑787). If successfully exploited, the attacker could escape the renderer sandbox and execute code with elevated privileges.