A use‑after‑free flaw in Chrome’s printing subsystem allows an attacker to craft an HTML page that triggers the vulnerability, causing arbitrary code to run inside the browser sandbox. The weakness is a classic memory‑management error (CWE‑416) and has been classified as High severity by Chromium. Attackers can execute code confined to the sandbox when they get the user to load the malicious page.

The vulnerability affects all editions of Google Chrome up to and including 156.0.8103.38, on all supported platforms. The fix, 157.0.8103.38, is released in the stable channel as of November 2026.

EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, but the CVSS score reflects a high‑risk flaw. The likely attack vector is a remote web page that the user loads, so the threat is limited to users who visit potentially malicious sites. Since code execution is confined to the sandbox, the attack impact is restricted to the browser environment, but still represents a significant risk for organizations unable to prevent exploitation until a patch arrives.