A memory corruption flaw was found in the DisplayLocking component of Google Chrome versions older than 156.0.8078.47. The vulnerability is a use‑after‑free (CWE-416) that can be triggered by a specially crafted HTML page. If successfully exploited, an attacker can execute arbitrary code in the renderer process; if the sandbox is bypassed, the attacker could run code with the privileges of the user, leading to full system compromise. The flaw carries a high severity rating, with a CVSS score of 8.8, indicating severe impact on confidentiality, integrity, and availability.

All Google Chrome browsers running any version earlier than 156.0.8078.47 are affected. The CNA data lists only the Chrome browser; no other product variants are impacted.

The CVSS score of 8.8 indicates a high potential impact if a successful exploit occurs. The EPSS score of 0.00417 (about 0.4%) suggests a very low but non‑zero current exploitation probability, meaning there is no widespread active exploitation yet but the risk should not be ignored. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote: a malicious website delivered over HTTP or HTTPS can embed a crafted HTML payload that, when rendered by a user in Chrome, triggers the memory corruption. Because the flaw originates in a sandboxed component, it may cause denial of service or, if sandbox escape is achieved, arbitrary code execution on the host. No publicly available exploit is documented at this time, but the high severity and potential privilege escalation warrant prompt remediation.