Google Chrome browsers before version 156.0.8078.73 contain a use‑after‑free flaw in the Layout component that allows a crafted HTML page to cause arbitrary code execution inside the browser's sandbox. The vulnerability is a classic example of CWE‑416, where freed memory is later accessed, potentially leading to the execution of attacker‑supplied code. The criticality of the flaw is reflected in the Chromium security severity label. The consequence is a full compromise of the sandboxed process and, with privilege‑escalation techniques, possible local system compromise.

All users running Chrome on any platform with a version earlier than 156.0.8078.73 are potentially impacted. The flaw exists regardless of operating system because the vulnerable logic resides in the cross‑platform layout engine. No specific vendor or OS variant is singled out; every Chrome installation prior to the fixed release is affected.

The flaw requires a user‑initiated visit to a malicious web page, so it is a client‑side vulnerability with an exploitation path that involves the user interacting with a crafted site. While the EPSS score is not available, the Chromium team has rated the flaw as critical and it is not yet listed in the CISA KEV catalog, indicating that widespread, automatic exploitation has not yet been observed. Nonetheless, the combination of a remote code execution vector, the difficulty of enforcing a sandbox break, and the widespread use of Chrome make the risk significant. Immediate action is recommended to prevent potential compromise.