Memory corruption in CSS parsing in Google Chrome versions prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Malicious CSS triggers an out‑of‑bounds write, leading to code execution. The Chromium security team has classified the issue as Critical.

Google Chrome. All instances running a version prior to 156.0.8078.47 are affected. Updating to 156.0.8078.47 or later removes the flaw; no other vendors are listed.

The CVSS score of 9.6 indicates a high‑severity exploit. The EPSS score of 0.559% indicates a very low exploitation probability, yet the vulnerability remains critical, especially if an attacker convinces a user to load a malicious HTML page. Once executed, arbitrary code runs with the privileges of the browser process, potentially compromising the host system.