Improper input validation in the WebShare component of Google Chrome prior to version 156.0.8078.47 can allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability, classified as CWE‑20, poses risks to confidentiality, integrity, and availability.

The vulnerability affects Google Chrome versions prior to 156.0.8078.47 on all platforms supported by Chrome. Any installation of Chrome that has not been updated beyond this release remains susceptible until a patch is applied.

The CVSS score of 8.8 indicates a high severity level. With an EPSS score below 1%, the likelihood of exploitation is considered low at present. The exploit is not listed in the CISA KEV catalog. The likely attack vector is remote, via a malicious HTML page that a user would open in Chrome. An attacker who has already compromised the renderer process could then load the crafted page to execute arbitrary code outside the sandbox during page rendering.