A use‑after‑free flaw was discovered in the Chrome Input module that allowed a remote attacker to execute arbitrary code inside the sandbox by delivering a specially crafted HTML page. The vulnerability falls under CWE‑416 and was rated as high severity by Chromium’s assessment.

The affected product is Google Chrome for desktop. Versions prior to 156.0.8078.79 are vulnerable. Any system running Chrome 156.0.8078.78 or earlier could be impacted.

The flaw can be exploited remotely by hosting a malicious HTML document or phishing an user. The attack vector is through the browser’s rendering engine, and the exploit can escape the sandbox to run native code. No EPSS score is available, and the vulnerability has not been listed in the CISA KEV catalog. Given the high severity assessment and the confirmed remote code execution capability, the risk remains significant until a patch is applied.