Based on the updated CVE description, a use‑after‑free flaw remains in Google Chrome’s WebSocket implementation. The modified description still indicates that a remote attacker can craft a malicious HTML page to trigger the use‑after‑free, potentially allowing execution of arbitrary code outside the sandbox. The flaw corresponds to CWE‑416 and is deemed a medium severity by Chromium, although the CVSS score of 8.8 reflects a high potential impact to affected systems.

Google Chrome for desktop users running any version before 156.0.8078.47 are vulnerable. No specific operating‑system restrictions are indicated, so all Chrome installations from the stable channel that have not yet applied the 156.0.8078.47 update could be impacted.

The CVSS score of 8.8 indicates a high potential for impact, and the expected attack vector is remote, mediated by a crafted HTML page. The EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation, but the lack of a KEV listing does not diminish the need for remediation. An attacker who can force a victim’s Chrome browser to load the malicious page could achieve arbitrary code execution with the privileges of the browser sandbox. The vulnerability does not require local access or privileged credentials beyond a normal user’s ability to open a URL.