The vulnerability is a use‑after‑free flaw in the Views component of Google Chrome up to version 156.0.8078.47, classified as CWE‑416 and CWE‑825. A remote attacker who has already compromised the renderer process can trigger this flaw by serving a specially crafted HTML page, potentially executing code outside the sandbox. Although the Chrome security severity is marked as low, the CVSS score of 8.8 indicates a high potential for arbitrarily executing code if the renderer is compromised.

Google Chrome browsers running versions prior to 156.0.8078.47 are affected. The flaw exists in the Views component that is part of the browser’s rendering engine. Users who have not upgraded to Chrome 156.0.8078.47 or later are vulnerable; all newer stable releases contain the patch.

The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% shows a low exploitation probability. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker delivering a malicious HTML page that a user opens in Chrome. To exploit the use‑after‑free, the attacker must first compromise the renderer process; once satisfied, the vulnerability can execute arbitrary code outside the sandbox. Exploitation therefore requires user interaction or phishing with a crafted page and prior renderer compromise, making it less likely to be widely abused.