The vulnerability is a use‑after‑free bug in Chrome’s Accessibility module. The flaw arises because the code fails to enforce proper authorization. Based on the description, an attacker who has already compromised the renderer process can trigger this bug with a specially crafted HTML page, causing the browser to execute arbitrary code outside of its sandbox.

Affected versions are Google Chrome releases prior to 156.0.8078.47 on desktop platforms. Based on the description, mobile versions are not explicitly mentioned and appear to be unaffected. The description does not reference a specific web application.

The CVSS score of 8.8 indicates high severity, and the EPSS score of <1% indicates a low likelihood of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Based on the description, exploitation requires that the attacker first gain a renderer process compromise, which may need another vulnerability or social engineering. Once that condition is met, the crafted HTML triggers the use‑after‑free and the missing authorization, allowing the attacker to run code with host privileges.