A use‑after‑free flaw in Chrome’s Paint implementation allows a remote attacker to execute arbitrary code inside the browser sandbox via a specially crafted HTML page. The vulnerability stems from the improper handling of freed memory and can lead to full compromise of the sandboxed process.

Google Chrome users running any version prior to 156.0.8078.73 are affected. The flaw exists in the Paint feature of the stable channel at the time of the release of 156.0.8078.73.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but its Chromium severity is High, indicating a serious risk. The likely attack vector is a remote attacker delivering a crafted HTML page to an unsuspecting user, which once rendered triggers the use‑after‑free and permits code execution inside the sandboxed browser process.