Use‑after‑free vulnerability in Chrome’s PictureInPicture feature—affecting versions before 156.0.8078.47—lets a remote attacker craft a malicious HTML page that, when a user opens it as part of a social‑engineering attack, causes the browser to dereference memory that has already been freed. This memory corruption can be leveraged to execute arbitrary code outside the browser sandbox, enabling any privileges that the browser process holds. The weakness is classified as CWE‑416, and the potential impact is full compromise of the user’s system if the attack succeeds.

Products from Google Chrome are affected, specifically all releases prior to version 156.0.8078.47. The vulnerability is documented for the stable channel update noted by Google and is relevant to users who have not yet upgraded to the patched browser.

The CVSS score of 8.8 indicates high severity. EPSS < 1% shows a very low probability of exploitation currently. The vulnerability is not listed in the CISA KEV catalog, so many teams may not be immediately aware. The attack vector is inferred to be remote, via a malicious web page that a user is tricked into visiting. An attacker leveraging social engineering can upload or embed this page, and successful exploitation results in code execution outside an otherwise sandboxed browser process.