Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allows a remote attacker to craft a malicious HTML page and, when viewed by a vulnerable user, potentially execute arbitrary code inside the browser's sandbox.

All installations of Google Chrome that are running a version older than 156.0.8078.47, on any operating system that Chrome supports, are affected. Users must upgrade to Chrome 156.0.8078.47 or later to remove the vulnerability.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is <1%, and the vulnerability is not present in the CISA KEV catalog, suggesting that while the flaw is potent, it may not yet be widely exploited in the wild. The logical attack vector is a crafted HTML page that a victim opens or visits, possibly embedded in an otherwise legitimate site. An attacker who succeeds can run code within the sandboxed environment, potentially leading to further compromise depending on the sandbox escape capabilities of the browser at that time.