A memory corruption flaw in the FileSystem component of Google Chrome enables a remote attacker to run arbitrary code inside the sandbox by loading a specially crafted HTML page. The vulnerability stems from an out‑of‑bounds write (CWE‑119) that can corrupt memory during file handling operations. If successfully exploited, the attacker can escape the sandbox and potentially compromise the user’s system or execute shellcode without user interaction.

Google Chrome browsers running any version older than 156.0.8078.79 are affected. All users of the stable, beta, or dev channels on desktop platforms with those versions are at risk.

The flaw carries a high severity rating, and the EPSS score is not available, but no known public exploits are listed and it is not in the CISA KEV catalog. Nonetheless, the attack vector is remote and only requires the user to load a malicious web page, which makes exploitation potentially straightforward once a page is delivered. The ability to execute code inside the sandbox raises the risk level for attacker persistence and lateral movement within the user’s machine.