A use‑after‑free bug was found in the Frames component of Google Chrome prior to version 156.0.8078.79. The flaw allows a remote attacker to supply a specially crafted HTML page that causes the browser to use freed memory, enabling execution of arbitrary code inside the sandbox. Failure of memory safety is a classic use‑after‑free (CWE‑416) and is rated as high severity by Chromium. If exploited, an attacker could run code with the privileges granted to the sandboxed renderer process.

This vulnerability affects Google Chrome for all supported operating systems – Windows, macOS, and Linux – for every stable‑channel release before 156.0.8078.79. Users running any earlier version of Chrome are susceptible to the flaw. The affected product is Google Chrome; no specific sub‑products are listed beyond the core browser.

The CVSS score is not published, and no EPSS information is available, indicating that the current probability of exploitation in the wild is unknown. The vulnerability is not listed in the CISA KEV catalog. A remote attacker can exploit the flaw by hosting or loading a malicious web page that uses the vulnerable Frames functionality. Because the attack requires an object in memory to be prematurely freed, it is a typical use‑after‑free exploit that can lead to arbitrary code execution inside the sandboxed rendering process.