Use after free in SVG in Google Chrome prior to 156.0.8078.47 enabled a remote attacker to potentially execute arbitrary code inside the browser sandbox through a crafted HTML page. The flaw stems from a use‑after‑free condition (CWE‑416) combined with uninitialized data usage (CWE‑825), allowing malicious content to trigger memory corruption and bypass sandbox restrictions.

The flaw affects Google Chrome versions earlier than 156.0.8078.47. Any system using a vulnerable build of Chrome is at risk until the vendor releases an updated package. Users of the stable channel are advised to verify their build number and update promptly.

The CVSS score of 8.8 reflects the high severity of a remote code execution that can bypass browser sandbox isolation. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation. The vulnerability is actively reported and not listed in CISA’s KEV catalog, indicating that it may not yet have widespread exploitation but still poses a significant risk. The likely attack vector is a malicious web page accessed over the network, where the attacker supplies crafted SVG or related HTML content to trigger the use‑after‑free.