Chrome's Media subsystem has a use‑after‑free flaw susceptible to exploitation by a compromised renderer process. A maliciously crafted HTML page served through social engineering enables arbitrary code execution outside the renderer sandbox. The vulnerability, classified as CWE‑416, allows attackers to run code with renderer privileges, potentially compromising sandboxed data and affecting confidentiality, integrity, and availability.

All Google Chrome installations running any version earlier than 156.0.8078.47 on any supported operating system are vulnerable. The affected component is the Media subsystem, which is used to handle audio and video playback on rendered web pages. No specific operating system restriction is mentioned, so the flaw applies to Chrome on Windows, macOS, Linux, and potentially other platforms supported by the browser.

The CVSS score of 8.8 indicates a high severity flaw, and the EPSS score of less than 1% suggests a low but nonzero likelihood of exploitation at this time. The Chrome vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. The likely attack vector is remote, via a malicious website that a user would need to visit. Because Chrome is widely installed, the potential impact is broad, and any user exposing Chrome to untrusted content is at risk until the fix is applied.