The vulnerability is a use‑after‑free flaw in Chrome’s WebGL implementation. When a malicious web page is loaded, the defect allows an attacker to read or write memory that has already been freed, which can be leveraged to execute arbitrary code inside the browser sandbox. This is a Remote Code Execution issue, classified as a high‑severity vulnerability.

All versions of Google Chrome older than 151.0.7922.169 are affected. The flaw exists in the WebGL component of the rendering engine and can be exploited through a crafted HTML page presented to the user.

The CVE is rated high severity and is not currently listed in the CISA KEV catalog. The exploit requires a user to visit a malicious web page; no user interaction beyond normal browsing is needed. The attack vector is remote, and the use‑after‑free can lead to arbitrary code execution within the sandbox, potentially allowing an attacker to bypass sandbox restrictions. Because the flaw is in a widely used browser, the risk of exploitation is significant, especially if users are not kept up to date.