Memory corruption in Skia, a graphics library used by Google Chrome, allows a crafted HTML page to trigger a buffer overflow. The flaw can be triggered remotely and enables an attacker to execute arbitrary code inside Chrome’s sandbox. The vulnerability is classified as a high‑severity memory corruption (CWE‑119) and compromises confidentiality, integrity and availability by allowing the attacker to run malicious code with the privileges granted to the browser process.

Google Chrome versions prior to 156.0.8078.73 are affected. Users of the stable channel, as well as any builds based on these versions, must upgrade to version 156.0.8078.73 or later to be protected.

The EPSS score is not available, but the CVE carries a high severity rating and is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a remote, crafted HTML page that can be delivered via a malicious website or local file. Because the vulnerability can be triggered from arbitrary web content, any user who visits an untrusted page or opens a malicious HTML file in Chrome is at risk.