A use‑after‑free flaw in Chrome’s compositing engine allows a remote attacker to execute arbitrary code inside the browser sandbox when a specially crafted HTML page is rendered. The vulnerability is located in code that fails to properly manage freed memory, leading to the execution of attacker supplied instructions. This results in a full code‑execution vector with no user interaction required other than visiting the malicious page.

The flaw affects all installations of Google Chrome prior to version 156.0.8078.47. Users running earlier Chrome builds on Windows, macOS, or Linux are at risk when they load the malicious content. The vendor product is Google Chrome; no additional sub‑product names are required.

The CVSS score of 8.8 indicates a high severity, and the vulnerability is listed as medium severity by Chromium. The EPSS score is reported as less than 1%, indicating a very low but non‑zero exploitation probability. The flaw is not listed in the CISA KEV catalog, but its impact space is large because any web page can be used as the attack vector. Given that the attacker only needs to deliver a crafted HTML page to a user, the likelihood of exploitation is significant, especially for users who access untrusted sites.