Memory corruption in the Document Object Model of Google Chrome, versions prior to 156.0.8078.79, allows a remote attacker to craft a malicious HTML page that can potentially cause arbitrary code execution within the browser sandbox. The flaw stems from improper bounds checking when processing DOM data (CWE‑119). While the code runs inside Chrome’s sandbox, it could compromise the underlying operating‑system if a sandbox escape were achieved or allow the attacker to elevate privileges within the sandbox context. The vulnerability is classified as high severity by Chromium security.

Google Chrome desktop versions earlier than 156.0.8078.79 on any platform are affected. The issue is tied to the Chrome renderer process that handles DOM parsing.

The CVSS score is not provided, but the Chromium team labeled the issue as High. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Within a typical browsing scenario the attacker must supply a crafted HTML page that the browser renders; no additional privileges or local code execution are required. Once the page is loaded, the memory corruption can be triggered, enabling potentially arbitrary code execution in the same sandbox process. Given the lack of a public exploit and the need for a malicious web page, the immediate threat is moderate for general users, but the impact remains significant for any environment that allows the rendering of external web content.