The vulnerability is a use‑after‑free flaw in Chrome’s quota subsystem that can be triggered by a maliciously crafted HTML page. When exploited, it allows a remote attacker to execute arbitrary code inside Chrome’s sandbox. Chromium classifies the issue as high severity, indicating a serious risk to confidentiality and integrity of the browser process.

Google Chrome users running any operating system with a version earlier than 156.0.8078.79 are affected. When updated to 156.0.8078.79 or later, the flaw is fixed. No other products are listed as impacted.

The known issue is remote in that a crafted web page can initiate the exploit; thus any user who visits such a page is at risk. While no EPSS score is available and the vulnerability is not in CISA’s KEV catalog, the high severity rating and the nature of the flaw imply a significant potential impact. Exploitation requires the attacker to win the user’s trust or lure them to a malicious site, after which code execution occurs inside the browser sandbox.