The vulnerability is a use‑after‑free flaw in Privacy in Google Chrome prior to 156.0.8078.47. A remote attacker who had compromised the renderer process can exploit this flaw by delivering a specially crafted HTML page that triggers the freed memory to be reused, allowing the execution of arbitrary code outside the browser’s sandbox. The weakness is classified as CWE‑416 and CWE‑825, a classic use‑after‑free issue that compromises both confidentiality and integrity by enabling code execution with the privileges of the browser process.

Google Chrome browser is affected. Any installation of Chrome before cumulative update 156.0.8078.47 is vulnerable. No specific sub‑release information is given, so all prior versions up to the patched build are impacted.

The CVSS score of 8.8 marks this as high severity. The EPSS score is <1%, indicating a low likelihood of exploitation, but the vulnerability is listed as not in the CISA KEV catalog. The attack vector is inferred to be a remote, crafted HTML page accessed over the network; an attacker who has already compromised the renderer process can trigger the freed memory to be reused, allowing execution of arbitrary code outside the sandbox, potentially leading to privilege escalation or data exfiltration within the user's machine.