A use‑after‑free memory corruption flaw in Skia, used by Google Chrome on Android, can be triggered by a crafted HTML page. The bug allows a remote attacker to execute arbitrary code outside the browser sandbox, enabling full compromise of the device. The weakness involves a buffer over‑read (CWE‑119) and an improper use after free (CWE‑416).

The affected product is Google Chrome for Android. No specific version list is supplied, but the public advisory references a fix delivered in the stable channel update for version 156.0.8078.47 and later. All Android devices running Chrome versions prior to this release are likely vulnerable.

The vulnerability is considered critical by Chromium, and the CVSS score is 6.5, indicating moderate severity. The EPSS score indicates a low probability of exploitation (<1%). It is not listed in the CISA KEV catalog. The attack vector is remote and requires delivering a malicious HTML page to the target device. Because the flaw involves a use‑after‑free that results in code execution outside the sandbox, successful exploitation requires the attacker to supply the crafted page, which may be mitigated by network controls or content filtering. Nonetheless, the moderate severity rating indicates that attackers who can deliver the payload can gain full control over the device.