A use‑after‑free vulnerability exists in Google Chrome’s CustomTabs component on Android versions prior to 156.0.8078.47. The flaw permits a remote attacker to supply a crafted HTML page that triggers arbitrary code execution outside the browser sandbox. By freeing a memory reference that is still accessed later during page rendering, an attacker can hijack execution flow, potentially compromising the device beyond the confines of the Chrome process.

The vulnerability affects Chrome for Android versions prior to 156.0.8078.47. Users running any earlier build of Google Chrome on Android devices are susceptible; newer releases contain the fix.

The CVSS score of 8.8 indicates high severity, and the vulnerability can be exploited without elevated privileges. The EPSS score of <1% signals a low probability of exploitation, but the potential impact remains significant. The flaw is not listed in the CISA KEV catalog, and no public exploitation evidence exists yet; nevertheless, the combination of remote code execution capability and the lack of sandbox containment warrants prompt remediation.