Incorrect reference resolution in the DevTools component of Google Chrome allows a remote attacker to potentially execute code outside the browser sandbox by loading a specially crafted HTML page. The failure in reference handling creates a sandbox escape path, which could compromise confidentiality, integrity, or availability of the system. This vulnerability is identified as CWE-706 and classified by Chromium as low severity, but sandbox escape elevates its real‑world impact.

Google Chrome builds older than version 156.0.8078.47 are affected. Any user running a prior Chrome release that has not applied the 156.0.8078.47 update may be able to contain vulnerable DevTools code.

The flaw can be triggered by a remote attacker who trick a victim into opening a malicious HTML page, such as via a phishing email or a malicious website. No credentials or privileged access are required, and the exploit can be performed over a normal web connection. The EPSS score of <1% indicates a low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the CVSS score of 6.5 and the ability to escape the sandbox justify a high remediation priority.