This vulnerability is a use‑after‑free flaw in the renderer’s input handling within Google Chrome. A maliciously crafted HTML page can trigger the flaw, causing the renderer process—already under attack—to execute arbitrary code outside the sandbox. The resulting code runs with the full privileges of the host machine, permitting the attacker to compromise confidentiality, integrity, and availability. The weakness is classified as CWE‑416.

All users of Google Chrome versions prior to 156.0.8078.47 are affected. The issue is present in the renderer process and applies to every platform that runs this browser version, including Windows, macOS, Linux, and Android. Users who load a malicious or compromised web page can trigger the flaw and potentially execute code outside the browser’s sandbox.

The CVSS score of 8.8 indicates a high‑severity vulnerability. Although the EPSS score is less than 1%, the flaw can be activated via a crafted HTML page delivered from a remote server, implying a remote attack. The exploit would require an attacker to deliver a malicious payload that, when processed by the compromised renderer process, triggers the use‑after‑free to execute code with elevated host privileges. The vulnerability is currently not listed in the CISA KEV catalog.