A memory corruption bug in Chrome’s PlatformIntegration component triggers a use‑after‑free that can be exploited via a crafted HTML page. A remote attacker could employ social engineering to get the page loaded, potentially allowing arbitrary code execution outside the sandbox. The flaw, rated medium severity by Chromium, leads to a CVSS score of 8.8, indicating significant risk to confidentiality, integrity, and availability if successfully leveraged.

All installations of Google Chrome running a version earlier than 156.0.8078.47 are vulnerable, including legacy desktop deployments that have not applied the latest update. The defect exists in the client‑side rendering engine and affects all platforms for which the flagged version was released.

With a CVSS score of 8.8 and an EPSS score of <1% (approximately 0.4%), the risk remains significant overall, but the likelihood of exploitation is low. The vulnerability can be triggered remotely by a malicious web page and does not require privileged access or local interaction. Although it is not yet listed in the CISA KEV catalog, the lack of a public exploit does not diminish the potential for adversaries to create their own exploitation tools.