The vulnerability is an out‑of‑bounds write in the Turbolev component of Google Chrome that existed before version 156.0.8078.47. A crafted HTML page can trigger the fault, allowing a remote attacker to execute arbitrary code inside the browser’s sandbox. This may lead to privilege escalation within the sandbox or even escape to the host system, compromising confidentiality, integrity, and availability of the affected machine.

The flaw affects all installations of Google Chrome that are older than version 156.0.8078.47. The fix was delivered in the stable channel release 156.0.8078.47, which updates the Turbolev module and removes the use‑after‑free condition. Any user running a prior revision is potentially vulnerable.

The CVSS score of 8.8 indicates high risk. The EPSS score of < 1 % shows a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a crafted HTML page that the victim must load, pointing to a remote web‑based vector that may also rely on user interaction or a compromised site. Because the bug targets a single component, exploitation is initially confined to sandboxed code, but a sandbox escape remains possible. Therefore vigilance and timely patching are strongly advised.