A use‑after‑free flaw in the Focus handling component of Google Chrome allows a malicious actor to read memory that has already been freed, which in turn lets them inject and execute arbitrary code within the browser’s sandboxed process. The vulnerability corresponds to CWE‑416 and can break the isolation that normally confers limited privileges, potentially providing a path to broader system compromise.

All installations of Google Chrome older than version 156.0.8078.47 are susceptible. This includes every platform that runs Chrome; the flaw exists in the core rendering engine and is not limited to a specific operating system or architecture.

The CVSS score of 8.8 marks this issue as high severity. The EPSS score is below 1%, indicating a very low yet non‑zero chance of exploitation at this time; the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, client‑side, that requires the victim to load a specially crafted web page, as inferred from the description. Should an attacker achieve exploitation, they would gain the privileges of the sandboxed browser process, potentially enabling higher‑level system actions.