This vulnerability is a use‑after‑free flaw in the Turbolev component of Google Chrome. A crafted HTML page can trigger the deallocation of a memory object and then use it again, allowing the attacker to run arbitrary code within the Chrome sandbox. The result is the potential execution of code with the privileges of the browser process, which may lead to system compromise if the sandbox is bypassed.

The flaw affects Google Chrome browsers of any OS that ship the affected version. Versions earlier than 156.0.8078.73 are impacted. The vulnerability is specific to the Chrome product line and does not affect other Google applications.

The issue is classified with high severity, and it can be exploited remotely by loading a malicious web page. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, but the nature of the flaw and the ability to bypass the sandbox give it a high potential for impact. The attack vector is via a manipulated web page that the user visits, so the risk can be mitigated by keeping the browser updated.