A memory corruption bug in Chrome’s FileSystem component allows a remote attacker to execute arbitrary code outside the browser sandbox by serving a specially crafted HTML page, resulting in a critical impact.

The vulnerability applies to Google Chrome versions earlier than 156.0.8078.73, specifically the stable channel builds distributed by Google.

Because the flaw can be triggered through a crafted HTML page, the likely attack vector is a malicious website or email attachment that a user views in Chrome. The absence of an EPSS score indicates no public exploitation data, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the critical severity and the potential to escape the sandbox suggest high risk if the browser is used to view untrusted content. No known workarounds exist; patching to 156.0.8078.73 or later is the only guaranteed mitigation.