Memory corruption in the Turbolev component of Google Chrome can be triggered by a crafted HTML page, enabling a remote attacker to run code outside the normal sandbox. The flaw is a classic out-of-bounds write, classified under the common weakness enumeration for buffer overrun. Successful exploitation would give an attacker arbitrary code execution on the affected system, compromising confidentiality, integrity, and availability of the victim's machine.

Google Chrome versions earlier than 156.0.8078.73 are affected. The vulnerability exists in the Turbolev renderer part of the Chromium engine used by Chrome on desktop platforms.

The exploit is achievable over the network by serving a malicious web page to a user who opens it in Chrome. The CVSS severity is High, and no EPSS score is available to indicate current prevalence. Because the flaw permits code execution outside the sandbox, its impact is severe. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the absence of an EPSS score does not preclude exploitation, especially for targeted attacks.