A use‑after‑free bug (CWE‑416) in Chrome’s ServiceWorker infrastructure, present in all builds prior to 156.0.8078.47, allows a maliciously crafted HTML page to trigger an exploitation path that results in arbitrary code execution outside the browser sandbox. This creates a remote code execution route for attackers against any user who opens the page in Chrome, potentially enabling further privilege escalation or system compromise.

The vulnerability applies to Google Chrome on all supported platforms using any build released before 156.0.8078.47. All users running these older releases are affected until a fixed build is installed.

Chromium assigns a CVSS score of 8.8, indicating a High severity. EPSS score for this issue is < 1%, indicating a very low but nonzero probability of exploitation, yet the high CVSS suggests realistic exploitation potential. The vulnerability is not listed in CISA’s KEV catalog. Because the attacker only needs to supply a crafted HTML page that is rendered by Chrome, the attack vector is likely a forced or socially engineered web browsing scenario. Successful exploitation could lead to sandbox escape and subsequent privilege escalation on the host.