A use‑after‑free flaw in the ANGLE graphics library of Google Chrome on Windows allows a remote attacker to trigger an out‑of‑bounds memory write with a specially crafted HTML page. The vulnerability leads to execution of arbitrary code outside the browser sandbox, providing a foothold for further attacks.

Google Chrome on Windows operating systems that are running any build prior to version 156.0.8078.47. All users with these unpatched binaries are exposed. The flaw is confined to the ANGLE graphics library used by Chromium.

The CVSS score of 8.8 indicates high severity, and the EPSS score is <1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves loading a malicious HTML page that triggers an out‑of‑bounds write in ANGLE, allowing remote attackers to execute arbitrary code outside the browser sandbox. Successful exploitation grants code execution outside the sandbox that can serve as a foothold for further attacks.