Use‑after‑free in Chrome’s WebAppInstalls on Android enables a remote attacker to exploit a dangling reference during a malicious app installation request. The flaw can run arbitrary code outside the browser sandbox via a co‑installed application, offering elevated privileges. The weakness is categorized as CWE‑416 and CWE‑825.

Android devices with Google Chrome versions earlier than 156.0.8078.47 are affected. The vulnerability is specific to Chrome on Android; other platforms are not impacted. Users running older Chrome releases should upgrade or disable WebAppInstalls to mitigate risk.

The CVSS score of 8.8 reflects high severity. EPSS indicates a probability of exploitation less than 1%, yet the issue remains publicly disclosed and is not listed in CISA KEV. An attacker would need a victim to engage with a malicious element, typically via social engineering, to trigger the vulnerable path. Successful exploitation could elevate code execution beyond the Chrome sandbox, potentially compromising the entire device.