Use-after-free in Google Chrome's Turbolev component affects versions prior to 156.0.8078.47 and lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (the victim must visit or render the malicious page), and successful code execution is confined to the sandbox; host compromise would require chaining a separate sandbox-escape flaw. Google rates this High severity (CVSS 8.8), and no public exploit was identified at time of analysis, though a vendor patch is available.
Memory corruption in Google Chrome's Scroll component affects desktop builds prior to 156.0.8078.47 and lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The user-interaction requirement (UI:R) is the main limiting factor: the attack is not self-propagating and depends on the target navigating to malicious or compromised content, after which the injected code runs only within Chrome's sandboxed renderer process - realistic host compromise would additionally require chaining a separate sandbox-escape flaw. The vendor has shipped a fixed build (156.0.8078.47); no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis, and no EPSS score was supplied to refine the likelihood estimate.
Memory corruption in the Extensions component of Google Chrome builds prior to 156.0.8078.47 lets remote attackers achieve arbitrary code execution inside the browser sandbox when a victim loads a crafted HTML page. The flaw is network-reachable, low-complexity, and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), with the only meaningful prerequisite being that the user render attacker-controlled content; exploitation is confined to the sandbox and would require chaining to a separate escape to reach the host OS. No public exploit code has been identified and the issue is not recorded as confirmed actively exploited (not in CISA KEV); Chromium rates the issue Medium security severity despite the elevated base score. Fix is available from the vendor in Chrome 156.0.8078.47.
Arbitrary code execution inside Chrome's renderer sandbox is possible in Google Chrome on Windows before 156.0.8078.47 through crafted HTML that triggers improper input validation in ANGLE. The attack is network-reachable, unauthenticated, and low-complexity but requires the victim to visit a malicious or compromised page; CVSS 3.1 is 8.8 (High), and successful exploitation is limited to code execution within the sandbox rather than direct host compromise. A vendor patch is available in 156.0.8078.47, and no public exploit or CISA KEV entry was identified at time of analysis.
Memory corruption in the GPU process of Google Chrome builds prior to 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code at the privilege level of the GPU service by convincing a victim to open a crafted HTML page (CVSS UI:R confirms user interaction is required). Because hardware acceleration is on by default, standard desktop installations are exposed without any custom configuration, and the 8.8 base score reflects full confidentiality and integrity impact within that process. Impact is bounded by the GPU sandbox - the vendor's own Medium severity rating and the assessed vector both indicate that escaping to the host requires chaining an additional sandbox-escape flaw; no public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.
Memory corruption in Google Chrome's Controls component allows remote, unauthenticated attackers to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Chrome prior to 156.0.8078.47 (UI:R is required). The vendor rates the issue Chromium severity Low because code execution is contained within the sandbox and meaningful host compromise would require a separate sandbox escape, even though the CVSS base score is 8.8; no public exploit was identified at time of analysis and a vendor patch is available.
Use-after-free in Google Chrome's Chromecast component allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page on any build prior to 156.0.8078.47. Exploitation is not passive: the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms mandatory user interaction, and the impact is bounded by Chrome's renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape flaw. Priority signals conflict - Chromium rates the issue Medium while the derived CVSS is 8.8 - and no public exploit code or confirmed active exploitation was identified at time of analysis; Google credits an internal Chrome security contact and restricts technical detail in the tracker.
Use-after-free in Chrome's GPU process lets remote attackers achieve code execution inside the browser sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires user interaction (UI:R) with no authentication needed (PR:N), though the code execution is confined to the GPU process sandbox (S:U) unless chained with a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Use-after-free memory corruption in Google Chrome for iOS prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation is not zero-click: the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attacker needs no credentials but must convince the target to open a malicious page, and any resulting code execution stays confined to the Chrome sandbox on iOS - escaping to the underlying device would require a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the risk picture is mixed: Google's Chromium team rates the flaw Low severity, while the CVSS 3.1 base score computes to 8.8 because of the high confidentiality, integrity and availability impact assumed for successful code execution; a vendor patch (156.0.8078.47) is available, so prioritization should weigh the Low vendor rating against the 8.8 vector rather than treating either signal as authoritative.
Use-after-free in Google Chrome's Extensions component (versions prior to 156.0.8078.47) lets a remote attacker who convinces a victim to open a crafted HTML page corrupt memory and execute arbitrary code inside the renderer sandbox, and can additionally crash the browser. Exploitation is not passive: it requires the target to load attacker-controlled web content, and because the CVSS scope is Unchanged, code execution stays confined to the sandbox - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though Chrome renderer memory-corruption bugs are historically attractive to exploit developers; the risk picture is mixed, with Chromium's own severity rating of Medium sitting well below the 8.8 CVSS score derived from the high confidentiality and integrity impact.
Memory corruption in Google Chrome for iOS before 156.0.8078.47 lets remote attackers who convince a user to load a crafted HTML page achieve arbitrary code execution inside the browser sandbox. The flaw requires user interaction (UI:R) but no credentials or privileges, and Chrome's default configuration on iOS is exposed. Google rates it Medium on its own severity scale while the CVSS base score is 8.8; exploitation is confined to the renderer sandbox, so full device compromise would require a separate sandbox-escape primitive, and no public exploit code or CISA KEV listing was identified at time of analysis.
Code execution inside the renderer sandbox is possible in Google Chrome builds prior to 156.0.8078.47 because of a use-after-free in the Accessibility component. A remote, unauthenticated attacker can trigger the flaw with a crafted HTML page, but exploitation requires the victim to visit attacker-controlled or attacker-injected content (UI:R), and the resulting code execution remains confined to the renderer sandbox unless chained with a separate sandbox escape. The vendor has released Chrome 156.0.8078.47 to fix the issue; no public exploit was identified at time of analysis.
Remote code execution inside the renderer sandbox affects Google Chrome prior to 156.0.8078.47 through memory corruption in the ServiceWorker component when a user visits a crafted HTML page. The issue requires user interaction but no authentication, and successful exploitation yields arbitrary code execution within Chrome's sandbox rather than direct host compromise; escaping the sandbox would require a separate vulnerability. No public exploit code or confirmed active exploitation was identified at the time of analysis, and Google has released a fixed Chrome build.
Memory corruption in the Accessibility component of Google Chrome for macOS allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page in any build prior to 156.0.8078.47. Exploitation requires user interaction (CVSS UI:R), and the resulting code execution is sandbox-confined (S:U), so full host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code or active exploitation has been identified at time of analysis, and Google has released Chrome 156.0.8078.47 to address the issue.
Arbitrary code execution inside the Chrome renderer sandbox affects Google Chrome versions prior to 156.0.8078.47 due to improper input validation in the Views component. A remote attacker can exploit the flaw by convincing a user to load a crafted HTML page; the attack requires user interaction (UI:R) but no authentication or privileges (PR:N). The vendor has released a patch, and the impact is contained by the sandbox (S:U), so this flaw alone does not compromise the host OS - it is a high-priority patch candidate rather than an emergency, and no public exploit identified at time of analysis.
Memory corruption in ANGLE, the graphics-translation layer that backs WebGL in Google Chrome, allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page on a build prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must load the attacker-controlled page - and any resulting code execution is confined to the renderer process, so host compromise requires chaining with a separate sandbox-escape flaw. Google rates the issue High severity and has shipped a vendor patch in 156.0.8078.47; no public exploit code was identified at time of analysis, and no CISA KEV listing is associated with this CVE.
Code execution inside Google Chrome's renderer sandbox is possible before version 156.0.8078.47 because of a use-after-free in the Media component that is triggered when a victim loads a crafted HTML page. The issue is unauthenticated from the attacker's perspective but requires user interaction (the victim must open the page), and the assessed CVSS vector scores it 8.8 with Scope:Unchanged, meaning compromise is confined to the sandbox unless a separate sandbox-escape flaw is chained. No public exploit was identified at time of analysis, and Google has released a fixed build, 156.0.8078.47; note that Chromium rated the bug Low severity while the CVSS score is High, a conflict that should inform risk decisions.
Memory corruption in Google Chrome's DevTools component prior to 156.0.8078.47 allows an unauthenticated remote attacker to potentially execute arbitrary code inside Chrome's sandbox by convincing a victim to open a crafted HTML page. Exploitation requires user interaction and depends on the DevTools code path, and the resulting execution is contained within the browser sandbox-host-level compromise would require a separate sandbox escape. Google has released a fixed build (156.0.8078.47); no public exploit was identified at time of analysis, and the vendor rated the issue Chromium severity Low.
Memory corruption in the Autofill component of Google Chrome on macOS (versions prior to 156.0.8078.47) lets an unauthenticated remote attacker who convinces a Mac user to load a crafted HTML page corrupt memory and potentially execute arbitrary code - but only inside the renderer sandbox. User interaction is mandatory (CVSS UI:R) and the platform scope is limited to macOS; Google rates the Chromium severity 'Low' precisely because escaping the sandbox would require chaining a separate vulnerability, and our independent assessment scores confidentiality, integrity and availability impact as Low rather than the High/High/High implied by the raw CVSS 8.8 base score. No active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, and a vendor patch is available.
Use-after-free in Chrome's ServiceWorker implementation allows a remote, unauthenticated attacker to run arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page that registers or manipulates a ServiceWorker, affecting Chrome builds prior to 156.0.8078.47. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R with high confidentiality, integrity, and availability impact, it scores 8.8, yet Google rates the issue only Medium - the description explicitly scopes the code execution to 'inside the sandbox,' so host or OS compromise requires chaining a separate sandbox-escape flaw. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad browser install base make this a genuine patch-priority item; note that exploitation requires user interaction (the victim must navigate to or render attacker-controlled content).
Google Chrome before 156.0.8078.47 contains a use-after-free in the Core component that can lead to arbitrary code execution inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R (score 8.8), so no authentication is required, but user interaction is the gating condition and the code execution is sandbox-confined unless chained with a separate escape. No public exploit code was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47.
Memory corruption in Google Chrome's Extensions component (all builds prior to 156.0.8078.47) allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation requires user interaction (CVSS UI:R) but no authentication or special configuration (PR:N), and the impact is bounded by Chrome's sandbox - absent a chained sandbox escape, the attacker does not obtain code execution on the underlying operating system. Google rates the Chromium security severity as Medium while the CVSS v3.1 base score is 8.8 (C:H/I:H/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, though the vendor has released a fixed build.
Improper input validation in Chrome's Network component (all desktop builds prior to 156.0.8078.47) allows a remote, unauthenticated attacker to potentially achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. Successful exploitation requires user interaction (CVSS UI:R), and because the scope is unchanged (S:U), any code execution stays confined to the sandboxed renderer rather than the host OS - which is why Chromium rates this 'Low' despite a base score of 8.8. Exploitation status: no public exploit identified at time of analysis; no CISA KEV listing and no EPSS data were supplied with this record.
Use-after-free in Google Chrome's Privacy component lets a remote attacker execute arbitrary code inside the renderer sandbox on any build prior to 156.0.8078.47, triggered simply by getting the victim to load a crafted HTML page (CVSS 8.8, AV:N/AC:L/PR:N/UI:R, scope unchanged). The flaw is a heap memory-lifetime corruption issue (CWE-416) whose realistic outcomes are renderer-level code execution or a browser crash/denial of service; escaping to the host operating system would require chaining a separate sandbox-escape bug, and Chrome's automatic updater rapidly shrinks the exposed population once the stable fix lands. Google shipped 156.0.8078.47 as the patched stable release, tracked as Chromium issue 558464760 and rated High by the Chromium security team; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Use-after-free memory corruption in Google Chrome's Extensions component (all versions prior to 156.0.8078.47) lets a remote attacker who convinces a victim to load a crafted HTML page run arbitrary code inside the browser sandbox; no authentication or prior privileges are required, but the victim must actively render attacker-controlled content (UI:R), and the resulting execution is confined to the sandbox. Rated 8.8 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H, CWE-416) with Chromium severity Medium - the gap reflects the sandbox boundary, which an attacker would need a separate escape to cross. No public exploit code and no CISA KEV listing were identified at time of analysis; a vendor patch is available.
Sandboxed remote code execution in Google Chrome prior to 156.0.8078.47 is caused by a use-after-free in the Transactions Platform component and is reachable when a victim loads a crafted HTML page. The issue is unauthenticated and low-complexity but requires user interaction, and code execution is confined to the renderer sandbox, so full host compromise would require chaining a separate sandbox escape. Multiple signals make this a genuine but not emergency-tier priority: a vendor patch is available, and no public exploit identified at time of analysis.
Remote code execution inside the Chrome renderer sandbox affects Google Chrome versions prior to 156.0.8078.47, where improper input validation in Loader can be triggered by a crafted HTML page. The CVSS vector indicates network reachability and no required privileges (PR:N), but exploitation requires a victim to visit or be navigated to attacker-controlled content (UI:R), and the resulting code execution is confined to the sandbox unless chained with a separate sandbox escape. No public exploit was identified at time of analysis; Google rates the issue Low even though the base CVSS score is 8.8.
Use-after-free in ANGLE, the WebGL/GPU translation layer shipped with Google Chrome on Windows, allows remote code execution inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. The CVSS 3.1 vector (8.8 High, AV:N/AC:L/PR:N/UI:R) reflects an unauthenticated, low-complexity attack that hinges only on the user visiting attacker-controlled content, a routine browsing action, though the CVSS integrity/availability impact is scored independently of the sandbox boundary that actually contains the payload. Google rates the underlying Chromium issue High severity; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV, but browser memory-corruption bugs of this class are routinely chained with a separate sandbox escape for full host compromise.
Memory corruption in Google Chrome's FullScreen component before version 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction to navigate to attacker-controlled content, and no public exploit was identified at time of analysis. The CVSS base score is 8.8, but realistic host compromise is limited unless the sandbox is separately escaped; Chromium rates the security severity as Low.
Use-after-free in Google Chrome's Input component before 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page (CVSS 8.8, UI:R). The raw score is high, but the independent assessment notes that code execution is confined to the renderer; full host compromise would require chaining a separate sandbox-escape flaw. No public exploit code or CISA KEV entry was identified at time of analysis, so risk signals are mixed and should be weighed with the user-interaction and sandbox constraints.
Arbitrary code execution inside the renderer sandbox is possible in Google Chrome before 156.0.8078.47 because PerformanceAPIs improperly validate attacker-controlled input from a crafted HTML page. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact with no privileges required, but exploitation requires the victim to load the page and remains confined to the renderer unless chained with a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, and Google has released a fixed build.
Memory corruption in Google Chrome's Core component before version 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction but no credentials, and the vendor rates the issue Chromium severity Low because the resulting code execution is confined to the renderer sandbox rather than the host OS. No public exploit code has been identified at time of analysis.
Google Chrome before 156.0.8078.47 contains a use-after-free in its Prompts component that can be triggered when a user opens crafted HTML content, allowing arbitrary code execution within the renderer sandbox. The CVSS vector indicates a remote, unauthenticated attack with required user interaction and high confidentiality, integrity, and availability impact, although Google rates the Chromium severity as Low and host-level compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the flaw.
Memory corruption in the Google Lens component of Google Chrome desktop builds before 156.0.8078.47 allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (the victim must navigate to attacker-controlled content), and the resulting code execution remains confined to the Chrome renderer sandbox; reaching the host operating system would require a separate sandbox-escape flaw. Google rates the issue Low (Chromium severity) despite the 8.8 CVSS score, no public exploit has been identified at time of analysis, and the vendor has released a fixed build (156.0.8078.47).
Memory corruption in Google Chrome's ANGLE graphics layer on Windows before 156.0.8078.47 enables remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and no authentication, and because the impact is sandbox-limited (S:U), an attacker would need a separate sandbox-escape flaw to compromise the host. Vendor patches are available in Chrome 156.0.8078.47, and no public exploit was identified at time of analysis.
Memory corruption in Chrome's XML handling allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page; the flaw affects Google Chrome desktop builds prior to 156.0.8078.47 and requires user interaction (the page must be loaded or rendered), with no authentication needed. Google rates the Chromium security severity as High and lists the issue privately in its tracker, and the vendor has released 156.0.8078.47 as the fixed build. Impact is bounded by the renderer sandbox: because the CVSS scope is Unchanged, code execution is confined to the sandboxed process and full host compromise would additionally require a separate sandbox-escape bug. No public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary code execution inside the Chrome renderer sandbox on macOS is possible with Google Chrome versions prior to 156.0.8078.47 when a user opens a crafted HTML page. The flaw is a use-after-free in Views rated CVSS 3.1 8.8 (High; AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), requiring user interaction but no authentication; code execution is confined to the renderer unless chained with a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Memory corruption in Google Chrome's SiteIsolation component affects desktop builds prior to 156.0.8078.47 and allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page (CVSS 8.8, UI:R). Impact is confined to the renderer sandbox under Scope:Unchanged, so full host compromise requires chaining a separate sandbox-escape vulnerability; no public exploit code was identified at time of analysis, and Google has released a fixed build.
A use-after-free in Google Chrome's Extensions component (CWE-416) affects all builds prior to 156.0.8078.47 and lets a remote attacker run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting low complexity and no authentication requirement but a mandatory user-interaction step; impact is confined to the sandbox, so host-level compromise would require chaining a separate sandbox escape. There is no CISA KEV listing and no public exploit code identified at time of analysis, and Google rates the Chromium security severity as Medium.
Use-after-free in Google Chrome's API layer prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The CVSS 3.1 vector (8.8) confirms network reachability and no privileges required, but exploitation is not zero-click: it requires user interaction to render the crafted page, and the impact is scope-limited to Chrome's sandbox (S:U). Google has released a fixed build, and no public exploit code was identified at time of analysis.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the ReadingMode component of Google Chrome builds prior to 156.0.8078.47, triggered when a victim opens a crafted HTML page. The flaw is unauthenticated from the network perspective but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and Google's own Chromium severity rating for this issue is Low - a sharp conflict with the 8.8 base score that materially changes how the risk should be weighed. Because the description confines the code execution to the sandbox, a complete host compromise would require chaining a separate sandbox-escape bug that this CVE does not supply; no public exploit was identified at the time of analysis, and a vendor patch is available in Chrome 156.0.8078.47.
Memory corruption in ANGLE, the graphics translation layer used by Google Chrome, allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page in any Chrome build prior to 156.0.8078.47. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms no credentials or special privileges are needed, but exploitation hinges on the user interaction metric - the target must actually visit or render the attacker-supplied content - and the impact is explicitly bounded to the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at the time of analysis, and Google has released Chrome 156.0.8078.47 to address the defect (Chromium severity: High).
Memory corruption in the Extensions component of Google Chrome before version 156.0.8078.47 allows remote code execution inside the browser sandbox when a victim opens a crafted HTML page, requiring user interaction (UI:R) but no authentication (PR:N). Successful exploitation is confined to the sandboxed renderer/extension process (S:U), so full host compromise would require a separate sandbox-escape flaw; this is why Chromium rates the issue Medium despite a CVSS 3.1 base score of 8.8. A vendor patch is available in Chrome 156.0.8078.47, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in Chrome for iOS versions prior to 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim navigates to a crafted HTML page. Exploitation requires user interaction and the code execution is confined to the sandbox, so full host compromise would require chaining a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis. The vendor rated the issue Low (likely reflecting the sandbox confinement), while the NVD CVSS 3.1 base score is 8.8 High.
Memory corruption in Google Chrome's video handling allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must visit or render the attacker-controlled page - and no special configuration is needed on default installations. No public exploit code was identified at time of analysis, and because the resulting code execution is contained by the Chromium renderer sandbox, a separate sandbox-escape flaw would be required to compromise the underlying host, which is the main limiting factor on real-world severity despite the 8.8 CVSS base score.
Memory corruption in the Back/Forward Cache (BFCache) component of Google Chrome allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page on any Chrome build prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects low attack complexity and full confidentiality/integrity impact within the compromised renderer, but user interaction is mandatory and code execution remains contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape flaw that this CVE does not provide. No public exploit code or confirmed active exploitation was identified at time of analysis; Google rates the issue Chromium security severity Medium and has released a stable-channel fix.
Use-after-free in Google Chrome's Extensions component before 156.0.8078.47 lets unauthenticated remote attackers potentially execute arbitrary code inside the Chrome sandbox when a victim visits a crafted HTML page. Exploitation requires user interaction (UI:R), and the resulting code execution is confined to the sandbox, so host-level compromise would require chaining with a separate sandbox escape. No public exploit was identified at time of analysis, but the vendor has released a fixed build and the issue should be treated as a high-priority patch item.
Memory corruption in the Core component of Google Chrome versions prior to 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, base 8.8) reflects a drive-by profile: no authentication or special configuration is required, but exploitation hinges on user interaction (UI:R), and the description explicitly confines code execution to 'inside the sandbox' - so an attacker remains limited to the renderer process and would need a chained sandbox escape to affect the underlying OS. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis, and Chromium's own severity rating for this issue is Low despite the 8.8 base score.
Memory corruption in Google Chrome's Chromoting (Chrome Remote Desktop) component before 156.0.8078.47 can allow a remote, unauthenticated attacker to potentially execute code inside Chrome's sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction, and the assessed impact is limited to low confidentiality, integrity, and availability because code execution is contained by the browser sandbox unless chained with a separate sandbox escape. No public exploit identified at time of analysis, no CISA KEV active exploitation is indicated in the supplied data, and Google has released a fixed build.
Memory corruption in Google Chrome's media handling before version 156.0.8078.47 can let a remote attacker potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The issue is rated CVSS 8.8 with user interaction required, and successful exploitation is confined to the sandbox, so full host compromise would require an additional sandbox escape. No CISA KEV listing or public exploit was identified at time of analysis, and no public exploit identified at time of analysis.