The updated description states that a use‑after‑free in the Accessibility component of Google Chrome before version 156.0.8078.47 enables a remote attacker to craft a malicious HTML page that can execute arbitrary code inside the browser sandbox. This classic memory integrity violation (CWE‑416) undermines the sandbox isolation, allowing an attacker to run code with sandboxed process privileges and potentially pivot to higher privileges if other vulnerabilities exist in the host OS or processes.

Google Chrome users running desktop versions older than 156.0.8078.47 on any supported operating system are impacted. The vulnerable component is part of the Chrome Accessibility layer and affects the standard stable channel. All installations of the affected versions are at risk, regardless of profile or specific settings.

The vulnerability carries a CVSS score of 8.8, marking it as High severity. The EPSS score is 0.0051, indicating a very low exploitation probability (< 1%). Because the flaw exists in code that is rendered in every web page, the attack vector is remote via a crafted HTML document, and no local privilege is required. The issue is not yet listed in CISA's KEV catalog, but its critical severity and memory corruption nature warrant immediate attention.