The vulnerability is a use‑after‑free bug in the Payments module of Google Chrome. It allows an attacker who has already compromised a renderer process to craft a malicious HTML page that may trigger the freed memory use and result in a sandbox escape. This leads to the potential execution of code with higher privileges than the renderer, effectively granting remote code execution capabilities. The weakness corresponds to CWE‑416, a memory management issue that can be exploited to violate process isolation.

The flaw affects Google Chrome prior to version 151.0.7922.109 on all supported operating systems. Any machine running a vulnerable Chrome version is at risk if the attacker can deliver a crafted HTML page to the compromised renderer.

The CVSS score is not provided, but the Chromium team rated the issue as high severity. Exploitation requires the attacker to already have gained control of a renderer process; thus it is not a pure remote exploit but relies on a prior foothold. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation to date. Nonetheless, because a sandbox escape could lead to arbitrary code execution at the machine level, the risk remains significant, especially in environments where renderer compromise is plausible.