The vulnerability is a use‑after‑free in Chrome’s Accessibility component on macOS. The updated description clarifies that a remote attacker who has compromised the renderer process can load a malicious HTML page that triggers this memory corruption, allowing arbitrary code to execute outside the browser sandbox. Chromium rates this flaw as high severity. The flaw grants attackers the ability to run code on the host system with privileges beyond the sandbox environment.

Google Chrome running on macOS, versions prior to 156.0.8078.47, are susceptible. Users on the stable channel before this build are affected.

The CVSS score of 8.8 indicates a high severity level. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploits yet. The exploit requires only a crafted HTML page to be delivered to a compromised renderer process, giving it a remote attack vector that could be widely abused. The combination of high severity and a low barrier to exploitation underlines an urgent risk to users exposed to untrusted web content.