The vulnerability is a use‑after‑free flaw in the Chrome Video component that can be triggered by a specially crafted HTML page. An attacker can gain the ability to execute arbitrary code within the Chrome sandbox, potentially allowing lateral movement beyond the sandbox if it is exploited. This defect is classified as CWE‑416 and was identified with a high severity rating in Chromium's security review.

All installations of Google Chrome prior to version 156.0.8078.73 are affected, including the standard desktop stable channel. Systems running older Chrome builds that have not yet received the 156.0.8078.73 security update are at risk.

The flaw permits arbitrary code execution through a remote HTML payload, and can be reached by simply rendering a malicious page in the victim's browser. The EPSS score is not available, but the issue is marked high severity by Chromium and is not listed in CISA's KEV catalog. Therefore, while the exact likelihood is unclear, the potential impact of a successful exploit is very serious, necessitating prompt remediation.