Use after free in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability is a classic CWE-416 use‑after‑free attack that can be triggered by loading malicious media streams in a victim’s Chrome browser.

Google Chrome browsers on all platforms using versions earlier than 156.0.8078.47 are affected. The vulnerability exists in the GetUserMedia API before this patch version.

The flaw receives a medium (6.5) CVSS score but can lead to code execution outside the sandbox if the renderer process is already compromised. Exploitation requires a remote attacker to serve a malicious web page that triggers the use‑after‑free in GetUserMedia. Because the EPSS score is <1% and the vulnerability is not listed in CISA's KEV catalog, the likelihood of exploitation remains low, though the potential impact is high if successful. Users are vulnerable only when visiting untrusted sites that supply crafted media streams, and no public exploit is known.