A memory corruption bug in Chrome's Network component permits a remote attacker to inject crafted HTML, potentially executing arbitrary code inside the browser sandbox. This flaw is a classic buffer overflow (CWE‑119) that can be exploited without requiring elevated privileges.

All users running Google Chrome versions earlier than 156.0.8078.79 on any supported operating system are vulnerable. The defect affects the Network module that parses HTML and related content delivered over the web.

The flaw carries a high severity rating in Chromium’s assessment, although an explicit CVSS score is not listed. No EPSS data is available and the vulnerability is not in CISA’s KEV catalog. An attacker could exploit the issue by compelling a user to visit a malicious web page; the attack vector is remote network traffic, with no local access required and no need for user interaction beyond opening the page. Active exploitation has not yet been reported, but the potential for remote code execution makes this a critical risk.