Use‑after‑free flaw in Chrome's Bookmarks handling code can be triggered by a crafted Chrome extension. The attacker that delivers such an extension can exploit the bug to run arbitrary code outside Chrome’s sandbox, bypassing the sandbox protection. Chromium labels this flaw as low severity, but it still allows remote code execution outside the sandbox. The vulnerability is identified as CWE‑416 and CWE‑825.

All installations of Google Chrome versions prior to 156.0.8078.47 are affected. The issue is specific to the Desktop Chrome stable channel and applies to browsers older than that release across all platforms. The problem originates in the Bookmarks feature and is not limited to a single operating system or architecture.

The CVSS score of 8.8 indicates high impact and the EPSS score of < 1% indicates a very low but non‑zero exploitation probability. The vulnerability is not currently listed in CISA’s KEV catalog, implying no known widespread use. The attack vector appears to be remote, requiring the attacker to deliver a malicious Chrome extension to the victim. Compromise would occur while the victim installs or activates the extension and would give the attacker code execution outside Chrome’s sandbox.