Use after free in Browser in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High). The flaw arises from improper handling of freed memory in a browser component, enabling attackers to trigger a use‑after‑free and subsequently run code with elevated privileges. The weakness is identified as CWE-416, and the impact is potential code execution that can compromise the device’s confidentiality, integrity, and availability.

The affected system is Google Chrome running on Android devices with releases earlier than 156.0.8078.47. No specific device models or OS versions are listed, but any Android device that still runs a Chrome browser version before the specified patch is at risk.

The vulnerability’s CVSS score is 6.5, indicating a medium severity. The EPSS score is < 1%, showing a very low probability of exploitation. The issue is not listed in CISA’s KEV catalog, indicating no publicly known exploits have been documented. Based on the description, the likely attack vector involves delivering a crafted HTML page to the target device, which can be executed remotely through a browser session. Because the flaw allows execution of arbitrary code outside the sandbox, an attacker could potentially compromise the entire device, leading to full system compromise.