Use after free in the Turbolev component of Google Chrome allowed a remote attacker to execute arbitrary code inside the sandbox of the browser through a specially crafted HTML page. The vulnerability is a classic CWE-416 flaw that could compromise the confidentiality, integrity, and availability of the affected system if the attacker was able to find a way to run the malicious code. The described impact is remote code execution.

Any installation of Google Chrome that ran a version earlier than 156.0.8078.47 was vulnerable. Users on the stable channel, as well as those who had manually installed older releases, faced this risk until the 156.0.8078.47 update was applied, which resolved the use‑after‑free bug.

The vulnerability carries a CVSS score of 8.8, which classifies it as a high‑severity flaw. No EPSS score is available, and it is not listed in the CISA KEV catalog, but the effective attack vector remains remote, as an attacker can host a malicious page and trick a user into opening it. Because the flaw involves a use‑after‑free condition that turns the sandbox into a full code execution context, once exploited it can allow an attacker to escape from the browser and potentially take over the local machine.