A use‑after‑free flaw in Chrome’s animation processing allows an attacker to execute arbitrary code within the browser sandbox when a user loads a crafted HTML page. This vulnerability is identified as CWE‑416, meaning the program uses a freed memory reference. The flaw can lead to full compromise of the user’s process or data because the attacker can run any code that the browser process can execute.

The vulnerability exists in all Google Chrome versions older than 156.0.8078.73 on desktop platforms. Users with any earlier Stable channel install remained exposed until the Chrome update is applied.

The severity is rated High, reflecting the potential for remote code execution from a simple web page. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, indicating that widespread exploitation has not yet been reported. The likely attack vector is delivering a malicious HTML file that contains the crafted animation payload. Exploitation requires user interaction to open the page, but once triggered, it achieves full execution within the sandboxed environment.