Use after free in the FileSystem component of Google Chrome before version 156.0.8078.79 permits a remote attacker to run arbitrary code inside the rendering sandbox when a user opens a specially crafted HTML page. The flaw is a classic use‑after‑free (CWE‑416) that can expose memory already reclaimed by the browser, leading to code execution with the privileges of the browser process while still inside the sandbox.

Google Chrome browsers on all supported platforms that installed a version prior to 156.0.8078.79 are affected. The vulnerability appears in the native FileSystem API used by web pages that request file access.

The CVSS indicates a high severity. No EPSS value is available, and the issue is not listed in CISA KEV, suggesting it has not yet been widely exploited in the wild. Nevertheless, the likely attack vector is a malicious web page shown in a user’s browser, with the attacker needing only to supply a crafted HTML payload. If the attack succeeds, arbitrary code runs within the sandboxed renderer, which, if escape mechanisms fail, could potentially compromise the host system.