An use-after-free bug in the Date handling code of Google Chrome before version 156.0.8078.47 allows a remote attacker to craft an HTML page that can escape the browser’s sandbox and execute code with elevated privileges. The flaw stems from CWE‑416, which involves improper use of freed memory. If exploited, an attacker could run arbitrary code on the user’s machine, compromising confidentiality, integrity, and availability of data.

Google Chrome users running any version earlier than 156.0.8078.47 are affected regardless of operating system, as the bug resides in the core rendering engine. The vulnerability is not limited to a specific component or platform, meaning all installations of the affected browser are at risk until patched.

The CVSS score of 9.6 indicates a severe risk, and the EPSS score is <1%, indicating a very low but nonzero likelihood of exploitation. Attackers could exploit the flaw via a web page hosted on an otherwise trusted site or through locally stored malicious content. Since the vulnerability leads to sandbox escape, an attacker can achieve full system compromise if the browser process can write to arbitrary memory or files.