This vulnerability is a use-after-free defect in the FileSystem API of Google Chrome. When a maliciously crafted HTML page is displayed, a reference to a freed memory area can be reprogrammed, allowing the attacker to run arbitrary code within the sandboxed environment. The potential damage includes executing malicious binaries with the privileges carried by the browser process, exfiltrating data from the user’s session, and modifying or deleting local files. The flaw falls under CWE-416.

The issue affects all Google Chrome installations older than version 156.0.8078.73 on desktop platforms. Users of the 2026.10 stable channel with a build prior to this number are susceptible.

Chromium’s internal assessment lists the bug as high severity; a CVSS score is not publicly documented. The EPSS score is not available, and the vulnerability is not part of the CISA KEV catalog, suggesting no documented exploited attacks as of this assessment. The attack requires the victim to visit a malicious web page, implying a drive-by or phishing scenario. Given the absence of current exploitation evidence, the exploitability is judged moderate while the potential impact remains high.