A use‑after‑free flaw in the ImageCapture component of Google Chrome versions before 156.0.8078.73 permits a remote attacker to run arbitrary code inside the sandbox by serving a specially crafted HTML page. The vulnerability is a classic memory management error that can be triggered via a normal web page, enabling the attacker to execute code with the privileges of the browser sandbox. The official Chromium severity rating is high, indicating a significant potential for exploitation.

Google Chrome is affected. Versions prior to 156.0.8078.73 lack the necessary safeguards and are susceptible to this flaw.

The exploit requires only that a victim visit a malicious web page, making it highly scalable and accessible to attackers that can embed the payload in compromised sites or phishing emails. Although no EPSS score is available, the high severity rating and lack of mitigation make it a critical risk. Google does not list this vulnerability in CISA KEV, but the potential for arbitrary code execution warrants immediate attention.