A use‑after‑free flaw in Google Chrome's WebRTC implementation before version 156.0.8078.47 lets a remote attacker serve a specially crafted HTML page that corrupts memory and executes arbitrary code within the sandboxed browser process. The vulnerability, designated CWE‑416, gives the attacker code‑execution privileges inside Chrome, enabling data theft, credential capture, or further compromise of the host system.

The defect exists in Google Chrome installations that have not yet reached version 156.0.8078.47. While the issue affects all builds (stable, beta, dev, canary), it is commonly inferred that most end users run the stable channel, so the highest risk is seen there; however, any Chrome version before the patch is potentially vulnerable.

The CVSS score of 8.8 indicates high severity. The EPSS score of <1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the flaw is remotely triggered via a malicious web page, meaning an attacker only needs to entice a user to visit a crafted site; the technical barrier is modest, but the low exploitation probability mitigates overall risk for today.