The vulnerability is a use‑after‑free in the ANGLE graphics layer of Google Chrome that can be triggered by a crafted HTML page. When exploited, it allows a remote attacker to execute arbitrary code outside the browser sandbox on Windows. This flaw corresponds to CWE‑125 and CWE‑416 and was rated high severity by Chromium security.

Google Chrome running on Windows environments with a version earlier than 156.0.8078.47 is affected. Users of the stable channel, as well as any build containing that snapshot, are vulnerable until the update is applied.

The vulnerability is remote and can be triggered by a malicious HTML document. When successfully exploited, it enables arbitrary code execution outside the sandbox, giving the attacker local privilege escalation on the victim’s Windows machine. The CVSS score of 6.5 still indicates medium severity, but the EPSS score of <1% implies a low probability of widespread exploitation. The CVSS, combined with the potential for code execution, makes the risk significant, and the issue remains not listed in the CISA KEV catalog.