Use after free in Frame handling in Google Chrome prior to 156.0.8078.47 permits a remote attacker to trigger an erroneous memory access, enabling code execution outside the sandbox through a crafted HTML page. When exploited, the attacker may achieve arbitrary code execution on the host machine.

All users of Google Chrome versions earlier than 156.0.8078.47 are susceptible. The flaw is present in the stable channel releases prior to that build and has no known mitigations beyond updating to the patched version. Systems running the affected release should treat all web content as potentially hazardous until the update is applied.

The CVSS score of 8.8 highlights a high severity risk to confidentiality, integrity, and availability. The EPSS score of < 1% indicates a very low probability that this vulnerability has been widely exploited at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector relies on a user visiting a crafted web page, which is a common scenario; however, exploitation requires the page to be executed in a vulnerable Chrome instance. Successful exploitation could bypass the browser sandbox and compromise the host operating system. While the attack surface is limited to the browser, the impact can extend well beyond the sandbox if the use‑after‑free is successfully triggered.