The vulnerability is a use‑after‑free bug in Chrome’s Proxy component that existed in versions before 156.0.8078.47. A remote attacker can send specially crafted network traffic to trigger a free of a memory object followed by reuse, enabling execution of arbitrary code outside the browser sandbox. The flaw is identified by CWE‑416 and carries a high severity rating.

Google Chrome browsers prior to version 156.0.8078.47 are affected, across all supported platforms that include the Proxy feature. The fix is contained in Chrome 156.0.8078.47 and later releases.

The assigned CVSS of 8.8 signals a high level of impact. The EPSS figure is less than 1 percent, indicating a very low probability of widespread exploitation today, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed attacks yet. Attackers could trigger the flaw by delivering tailored network traffic to the vulnerable Proxy component; no elevated privileges are required, but success would allow code execution outside of the browser sandbox, potentially leading to system compromise.