A use‑after‑free flaw exists in the Streaming component of Google Chrome prior to version 156.0.8078.47. When a crafted network traffic payload is received, the browser may execute malicious code inside its sandbox. This vulnerability, classified as CWE-416, can lead to arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected system.

The flaw affects all Google Chrome installations on desktop operating systems running a version earlier than 156.0.8078.47. No specific hardware or OS variations are noted, so all standard desktop configurations are at risk.

The CVSS score of 8.8 indicates high severity, while the EPSS analysis indicates a low but non‑zero exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog, and the attack vector is inferred to be remote: an attacker can send crafted network traffic that a user receives or otherwise processes in Chrome. Because execution occurs inside the sandbox, an exploited process could potentially escape the sandbox boundaries, resulting in full system compromise depending on sandbox fidelity and operating system defenses.