A memory corruption bug in Chrome's Autofill component allows a remote attacker to craft an HTML page that causes the browser to execute arbitrary code inside the sandbox. The flaw leads to a local privilege escalation within the sandbox process, providing the attacker with the ability to run malicious payloads that could potentially escape to the underlying operating system. The weakness is a classic out‑of‑bounds write (CWE‑119).

All users running Google Chrome versions earlier than 156.0.8078.79 on any supported operating system are affected. The patch was released in the 156.0.8078.79 update, which contains the fix for the autofill memory corruption.

The issue is rated high severity by Chromium, but no EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. Attackers would need to host a malicious HTML file or embed the exploit in a phishing page to lure victims, implying a network‑based attack vector from an untrusted web source. Given the potential to escape the sandbox and compromise the host, the risk is significant while exploitation likelihood is uncertain due to lack of public exploit evidence.