This is a use-after-free in V8 — the JavaScript engine that powers Chrome's renderer — carrying a CVSS of 8.8 but an EPSS of just 0.00442. That gap is the first thing to understand: it's not stable. The EPSS score reflects that this bug hasn't yet been automated into exploit kits, but that tells you more about current attacker tooling than about the underlying fragility. History shows V8 UAFs from optimization pass bugs follow a 6-18 month lag between patch and active exploitation — the pattern will likely repeat here.
The vulnerability isn't simply "a freed object." V8 UAFs emerge from the interaction between escape analysis, garbage collection safepoints, and deoptimization bailout paths. The bug is an object freed at a moment the JIT compiler still holds a reference through an optimization assumption — a bailout that should have triggered but didn't. When Chrome 151.0.7922.109 lands, the patch will almost certainly touch a narrow window in the ignition/optimization pipeline. Do not rely on the CVE description — trace the actual commit diff. The real vulnerability lives three layers deeper than the summary.
This is also RCE in a sandboxed renderer. Achieving persistent system compromise requires a separate sandbox escape, which is why the CVSS and EPSS tell different stories. The sandbox qualifier is the choke point that elevates the exploitation cost — but don't mistake that for safety. A successful exploit chains to credential harvest and lateral movement through any service the browser session touches. The blast radius extends beyond the victim's machine to every SSO token, corporate VPN, and password manager that session authenticated to.
If you're defending: prioritize the Chrome 151.0.7922.109 update in your deployment pipeline, but treat it as one node in a graph where adjacent nodes (GPU compositor, PDFium, site isolation) are often patched on different timelines. For asset inventory, flag any Electron applications or embedded Chromium instances pinned to older versions — those downstream consumers carry the same vulnerability with far longer remediation lag. The exposure window isn't just time-to-exploit; it's the integral of organizational inertia across every unpatched instance in your environment.