The vulnerability is a use‑after‑free condition in the Actor component of Google Chrome, prior to 156.0.8078.47. It allows a remote attacker to supply a crafted HTML page that triggers the use‑after‑free, leading to arbitrary code execution inside the browser sandbox. Depending on the sandbox configuration, this may enable an attacker to escape the sandbox and compromise the host system’s confidentiality, integrity, and availability. The weakness is identified as CWE‑416.

All desktop installations of Google Chrome running a version prior to 156.0.8078.47 are affected. The flaw exists in the Actor implementation included in those builds. Upgrading to the latest stable channel release observed in October 2026 resolves the issue.

The CVSS score of 8.8 indicates high severity, while the EPSS score of 0.00443 (<1%) shows only a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting that known exploits have not yet been confirmed in the wild. The likely attack vector is a malicious web page that exploits the Actor parsing path, which is reachable from any user who opens the crafted page in Chrome. Because the flaw can lead to arbitrary code execution within the browser sandbox, the risk is significant especially if the sandbox can be escaped. Maintaining the latest patched version is essential to mitigate the exposed attack surface.