The flaw is a use‑after‑free memory corruption issue in Google Chrome's Views component. Prior to version 156.0.8078.47, a remote attacker could supply a specially crafted HTML page that triggers the vulnerability, potentially allowing execution of arbitrary code outside the browser sandbox. The weakness is identified as CWE‑416 and could be leveraged for sandbox escape if additional exploits are available.

All installations of Google Chrome are potentially affected, particularly versions prior to 156.0.8078.47. The available data does not specify the exact revision or patch that resolves the issue, so users should assume any pre‑156.0.8078.47 build may be vulnerable.

The CVSS score of 8.8 indicates high severity, but the EPSS score is less than 1%, suggesting a very low exploitation probability at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via a crafted HTML page that a user opens, which means the risk is greatest when users visit untrusted or malicious web content.