Use‑after‑free vulnerability in the Skia graphics engine used by Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox by delivering a specially crafted HTML page. This flaw can lead to arbitrary code execution within the sandboxed environment, potentially enabling local privilege escalation or access to privileged data that the browser may have. The scenario does not require the user to install malware, only to visit the malicious content.

Google Chrome versions earlier than 156.0.8078.79 on desktop platforms (Windows, macOS, Linux) are affected. The vulnerability resides in the desktop channel of Chrome and is not known to impact the mobile browser or other Chromium‑based products.

Chromium classifies the issue as high severity and it currently does not have an EPSS score or a listing in the CISA KEV catalog. Attack vectors are remote; an adversary must persuade a user to load a malicious web page. Exploitation requires no special privileges beyond normal browsing rights, but the arbitrarily executed code runs inside the sandbox. Escalating to higher privileges would depend on other sandbox escape mechanisms, which are mitigated by hardened sandbox implementations. Nonetheless, the flaw remains a compelling target for threat actors seeking local privilege escalation from web content.