Use after free in Chrome’s Media component before version 156.0.8078.47 occurs when processing a crafted HTML page, allowing a remote attacker to execute arbitrary code inside the sandboxed rendering process. The flaw is a memory safety issue corresponding to an improper use of freed memory.

Systems running Google Chrome versions older than 156.0.8078.47 are affected. This includes all desktop variants of Chrome (stable channel) on Windows, macOS, Linux, and Chrome OS until the corresponding security release.

The vulnerability can be triggered over the network by serving a malicious HTML page to a victim. No local privileges are required, and the attacker can run code within the sandbox. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low exploitation likelihood. However, the CVSS score of 6.5 (moderate severity) and the ability to execute code inside a sandboxed process still represent a non‑negligible risk for malicious actors with sufficient resources.