Google Chrome versions older than 156.0.8078.47 contain a buffer overflow in the Video component. When the browser parses a specially crafted web page, the uninitialized resource can be exploited to execute arbitrary code outside the browser sandbox. The flaw is a type of buffer overflow (CWE-908) that allows a remote attacker to take full control of the system. Because the trigger occurs from a visitor’s webpage, the attack vector is remote via malicious HTML content.

The vulnerability affects Google Chrome versions older than 156.0.8078.47. Users running any 156.0.x build below 156.0.8078.47 are at risk unless they patch to the fixed release.

The flaw has a CVSS score of 8.8, indicating high severity, and its EPSS score is < 1%, indicating a very low exploitation probability, and it is not listed in CISA's KEV catalog. An attacker can exploit it by hosting a malicious page and luring a user to visit it, taking advantage of the remote nature of the flaw. The attack vector is therefore remote via malicious HTML content; based on the description, it is inferred that the victim must load the crafted page in Chrome to trigger exploitation. The vulnerability is identified as CWE-908.