Use after free in Blink, the rendering engine of Chrome, allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The flaw can lead to executable code running with the browser’s privileges, providing a path to escape the sandbox and potentially compromise the host system.

Google Chrome versions prior to 156.0.8078.79 are affected. This includes all stable channel releases at or below that build number. No additional sub‑version details are provided.

Chromium rates the vulnerability as High. The EPSS score is not disclosed and the CVE is not listed in CISA’s KEV catalog. Exploitation requires a malicious web page to be loaded; the attack vector is thus network‑based (e.g., visiting a compromised site). Once the crafted page is rendered, the use‑after‑free can escape the sandbox, elevating the impact to full system compromise.