This vulnerability involves a use-after-free in the Chromoting component of Google Chrome, a CWE-416 flaw. Crafted network traffic can trigger the defect, allowing an attacker who has compromised the renderer process to execute arbitrary code outside the sandbox. The primary impact is execution outside the sandbox, potentially compromising all system resources accessible to the user.

Google Chrome users running any version prior to 156.0.8078.47 are impacted. The Chromoting feature is present in all stable releases of Chrome up to that version, so any installation of Chrome before the specified update is vulnerable.

With a CVSS score of 8.8, the flaw is considered high severity. An attacker can exploit it remotely by delivering crafted network traffic that triggers the use-after-free in the Chromoting component of Chrome. The EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV, but the absence of a listing does not mitigate the inherent risk. Successful exploitation would allow the attacker to execute arbitrary code outside the browser sandbox.