The vulnerability is a use‑after‑free flaw in Chrome’s WebGL implementation. When a malicious web page is loaded, the defect allows an attacker to read or write memory that has already been freed, which can be leveraged to execute arbitrary code inside the browser sandbox. This is a Remote Code Execution issue, classified as a high‑severity vulnerability.

All versions Google Chrome older than 151.0.7922.169 are affected. The flaw exists in the WebGL component of the rendering engine and can be exploited through a crafted HTML page presented to the user.

The CVE, with a CVSS score of 8.8 and an EPSS score of < 1%, indicates a very low but non‑zero exploitation probability, is rated high severity and is not currently listed in the CISA KEV catalog. The exploit requires a user to visit a malicious web page; no user interaction beyond normal browsing is needed. The attack vector is remote, and the use‑after‑free can lead to code execution within the sandbox, potentially allowing an attacker to bypass sandbox restrictions. Because the flaw is in a widely used browser, the risk of exploitation is significant, especially if users are not kept up to date.