A use‑after‑free vulnerability in the streaming module of Google Chrome versions older than 156.0.8078.47 can be triggered by a specially crafted network payload. The flaw allows the renderer process to dereference freed memory, giving the attacker the ability to run code inside the sandbox. This is identified as improper memory management (CWE‑416) and can facilitate code execution in the sandbox context (CWE‑825).

The flaw impacts all installations of Google Chrome that have not yet been upgraded to build 156.0.8078.47 or later. The vendor does not limit the issue to a particular channel or operating system; consequently, every platform supported by Chrome—Windows, macOS, Linux, and ChromeOS—remains vulnerable if it runs an affected version.

The vulnerability receives a CVSS score of 8.8, indicating high severity. Exploitation requires delivery of a specially crafted network flow, making it a remote attack vector that can be triggered from any site or via social engineering. The EPSS score is less than 1 %, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that active exploitation is currently rare. Nevertheless, because the flaw permits code execution inside the renderer sandbox, it poses a significant risk to users who allow the browser to load arbitrary content.