Incomplete cleanup in Chrome’s GPU component permits a remote attacker who has compromised the renderer process to execute arbitrary native code outside the sandbox via a crafted HTML page. This flaw is an Incomplete cleanup weakness (CWE‑459), which can compromise confidentiality, integrity, and availability if exploited.

All editions of Google Chrome that are running versions earlier than 156.0.8078.47 are vulnerable. The issue is present across all supported operating systems for this major version series.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score of < 1% indicates a low, but non‑zero, likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. The likely attack pathway involves a remote attacker who first compromises the renderer process, possibly through other browser vulnerabilities or local attacks, and then can use a crafted HTML page to trigger code execution outside the sandbox. Because the flaw allows arbitrary code execution after renderer compromise, the risk is significant if the attacker gains that level of access, especially when users interact with untrusted web content.