Use-after-free memory corruption in ANGLE, Chrome's OpenGL ES abstraction layer, allows remote attackers to execute arbitrary code inside the renderer sandbox in Google Chrome versions prior to 156.0.8078.47 when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated from the network but requires mandatory user interaction to render the malicious content, and the resulting code execution is contained by Chrome's renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw; Google rates the Chromium security severity as Low, which is consistent with that containment. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied; a vendor patch is available in Chrome 156.0.8078.47.
Memory corruption in Google Chrome DevTools before 156.0.8078.47 can let a remote, unauthenticated attacker execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page and then engages DevTools against it. Exploitation is constrained by required user interaction and the fact that DevTools is a developer feature not active during routine browsing; our adjusted assessment raises attack complexity to High, so despite the headline CVSS 8.8 the real-world priority is moderate. No public exploit identified at time of analysis.
Memory corruption in the ANGLE graphics translation layer of Google Chrome on Windows allows remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page, affecting versions prior to 156.0.8078.47. The attack requires user interaction (UI:R) but no authentication, and default Chrome configurations are exposed because ANGLE is the standard WebGL/graphics backend. Code execution is confined to the Chrome sandbox, so host compromise would require chaining with a separate sandbox escape; no public exploit has been identified at time of analysis, and a vendor patch is available in 156.0.8078.47.
Memory corruption in Google Chrome's PlatformIntegration component allows remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page, affecting Chrome versions prior to 156.0.8078.47. Exploitation requires user interaction but no authentication, and the CVSS 3.1 score is 8.8; however, code execution is confined within the sandbox unless the attacker chains a separate sandbox-escape vulnerability. No public exploit was identified at time of analysis, and Google has released a patched stable-channel build.
Memory corruption in the DevTools component of Google Chrome builds prior to 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the Chrome sandbox when a victim opens a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms no authentication is required, but exploitation hinges on user interaction (UI:R), and code execution is confined to the renderer sandbox unless chained with a separate sandbox-escape flaw. No public exploit code or CISA KEV active-exploitation entry is in the available data, and Chromium rated the underlying security severity as Low despite the 8.8 CVSS base score.
Memory corruption in Google Chrome's Bluetooth implementation before version 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox by convincing a user to open a crafted HTML page. Exploitation requires user interaction to load the page (CVSS UI:R), and because the assessed scope is unchanged, compromise of the host operating system or other origins would require a separate sandbox-escape vulnerability. No public exploit code or CISA KEV listing was identified at the time of analysis, but the vendor has released Chrome 156.0.8078.47 to correct the flaw.
Google Chrome before 156.0.8078.47 contains a use-after-free in the Actor component that allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and the impact is sandbox-confined rather than host-level code execution unless a separate sandbox escape is chained. The vendor has released Chrome 156.0.8078.47, Chromium rated the issue Low, and no public exploit was identified at time of analysis; the supplied 8.8 base score conflicts with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L vector.
Memory corruption in the DevTools component of Google Chrome desktop builds prior to 156.0.8078.47 allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the Chrome renderer sandbox by convincing a victim to open a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). The required user interaction and the fact that execution is confined within the sandbox - no sandbox escape or host compromise was demonstrated - are the key limiting factors, which is why Chromium assigned this a security severity of Low despite the high base score. No public exploit code or confirmed active exploitation was identified in the available intelligence, and EPSS data was not provided, so real-world risk should be treated as contextual rather than demonstrated; signals conflict and must be weighed carefully, since the high CVSS and RCE tag coexist with a Low vendor severity and sandbox confinement. Fixed builds are available from the vendor in Chrome 156.0.8078.47 and later.
Memory corruption in Google Chrome's DataTransfer component can potentially allow a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page in a build prior to 156.0.8078.47. The CVSS 8.8 rating reflects high confidentiality and integrity impact, but exploitation requires user interaction (UI:R) and does not by itself escape the renderer sandbox (S:U), so host-level compromise would require a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, and Google has released a fixed build, 156.0.8078.47.
Use-after-free in Google Chrome's GPU component allows remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page; all Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires only that a user navigate to attacker-controlled content (no authentication, default configurations exposed). Successful exploitation yields high confidentiality and integrity impact but remains scope-unchanged - code executes inside the renderer/GPU sandbox, so host compromise requires chaining a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium severity as Medium even though the CVSS base score computes to 8.8. A vendor-released patch in Chrome 156.0.8078.47 is available.
Remote code execution inside Chrome's renderer sandbox is possible in Google Chrome versions prior to 156.0.8078.47 through crafted HTML that exercises the Media component. The CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:N/UI:R), so exploitation is remote and unauthenticated but requires the victim to load attacker-controlled content; impact is confined to the sandbox and host compromise would require a separate sandbox escape. Google has released the fixed 156.0.8078.47 build, and no public exploit identified at time of analysis; Chromium rates the issue Medium despite the High CVSS score.
Use-after-free in Chrome's Network component on Windows lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the browser sandbox. All Windows Chrome builds prior to 156.0.8078.47 are affected; exploiting it requires user interaction (rendering attacker-controlled content) but no credentials, and the resulting code execution is contained by the sandbox, so full host compromise needs chaining with a separate sandbox escape. Google rates it High severity and a fixed build is available; no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper input validation in the ANGLE graphics translation layer shipped with Google Chrome on macOS before 156.0.8078.47 permits a remote attacker to achieve code execution inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the macOS user must actively visit or load attacker-controlled content - and the resulting code execution remains contained within the sandbox (Scope:Unchanged), meaning a separate sandbox escape is required for full host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed build (156.0.8078.47); Chromium rated the issue High severity and the CVSS 3.1 base score is 8.8.
Use-after-free in Google Chrome's Transactions Platform lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 156.0.8078.47. Exploitation is unauthenticated per the CVSS vector (PR:N) but requires the user to navigate to attacker-controlled content (UI:R), and because scope is Unchanged the resulting code execution is confined to the sandbox - full host compromise would require chaining a separate sandbox escape. Severity signals conflict and should temper the headline score: NVD-style scoring yields 8.8 while Google rates this Chromium severity Medium, and no CISA KEV listing or public exploit code was identified at time of analysis, so the practical risk is best framed as a high-impact but interaction-gated memory-corruption primitive rather than a confirmed actively exploited threat.
Use-after-free in Google Chrome's SignIn component before version 156.0.8078.47 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. Exploitation requires user interaction (UI:R) and remains bounded by Chrome's sandbox, so host compromise would require a separate sandbox-escape vulnerability; Google rates the Chromium security severity as Low despite a CVSS score of 8.8. No public exploit or CISA KEV listing was identified at time of analysis, and a vendor patch is available.
Use-after-free in Google Chrome's Extensions subsystem enables remote code execution inside the renderer sandbox when a victim opens attacker-controlled crafted HTML, affecting desktop builds prior to 156.0.8078.47. The attack is unauthenticated over the network but requires user interaction (CVSS UI:R), and because the scope is unchanged (S:U), the code execution is contained by the browser sandbox - full host compromise would need a separate sandbox escape. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) on record; risk is moderated by Chrome's auto-update cadence, since users already on 156.0.8078.47 or later are not exploitable.
Use-after-free in Google Chrome's compositing component enables remote code execution inside the browser sandbox when a victim loads a crafted HTML page, affecting Chrome builds prior to 156.0.8078.47. The CVSS vector indicates unauthenticated network access but requires user interaction (UI:R), and the description limits impact to code execution inside the sandbox rather than host escape without a separate sandbox-escape flaw. No public exploit code was identified at time of analysis; Google has released Chrome 156.0.8078.47 as the vendor fix, and risk is tempered by sandbox containment and the need to lure a user to attacker-controlled HTML.
Memory corruption in Google Chrome's Shadow DOM implementation allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting desktop Chrome builds prior to 156.0.8078.47. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact within the compromised renderer, but with unchanged scope and execution confined 'inside the sandbox,' full host compromise would require chaining a separate sandbox-escape flaw. Chromium's own security severity rating is Medium, Google has shipped a fixed build, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in Google Chrome's API before 156.0.8078.47 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to open a crafted HTML page. The flaw is classified as CWE-119 and scored CVSSv3.1 8.8 (AV:N/AC:L/PR:N/UI:R), so user interaction is required but no credentials or special configuration are needed. Google has released Chrome 156.0.8078.47 to address the issue, and no public exploit code or CISA KEV entry was identified at the time of analysis.
Use-after-free in Google Chrome's Script component before 156.0.8078.47 allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and works against default browser configurations, but the code execution is contained by the Chrome sandbox, so host compromise would require chaining a separate sandbox-escape flaw. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis.
Memory corruption in Google Chrome's Skia graphics library prior to 156.0.8078.47 allows remote code execution inside the sandboxed renderer when a user loads a crafted HTML page. The flaw is network-reachable, requires no privileges, and affects default desktop configurations, but exploitation depends on user interaction with malicious web content and code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. No public exploit code was identified at time of analysis, and a vendor patch is available in Chrome 156.0.8078.47.
Use-after-free in Google Chrome's Extensions component (all builds prior to 156.0.8078.47) lets remote unauthenticated attackers run arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring only one click or a drive-by page visit. Rated CVSS 3.1 8.8 (High) with Chromium security severity Medium, the flaw's reach is bounded by sandbox confinement (Scope:Unchanged) - escaping to the host OS or user data requires chaining a separate sandbox-escape bug. No public exploit code or confirmed active exploitation was identified at time of analysis; patched builds 156.0.8078.47 and later are not vulnerable.
Memory corruption in Chrome's Frames component allows a remote attacker who convinces a victim to open a crafted HTML page to achieve arbitrary code execution inside the Chromium renderer sandbox. All Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires no authentication - the only real barrier is the mandatory user interaction of loading attacker-controlled frame content (CVSS UI:R). Google rates the issue High severity (Chromium) and lists it as fixed in the 156.0.8078.47 stable release; no public exploit code has been identified at time of analysis, and the practical impact is bounded by the sandbox, so full host compromise would require chaining with a separate sandbox-escape flaw.
Memory corruption in Google Chrome's Audio component before version 156.0.8078.47 allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is network-reachable, low complexity, and requires no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but exploitation depends on user interaction - the target must navigate to attacker-controlled content that triggers the audio processing path - and resulting code execution is confined to the sandboxed renderer, so host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a vendor patch in Chrome 156.0.8078.47.
Use-after-free in Google Chrome's FileSystem component allows a remote, unauthenticated attacker to potentially achieve arbitrary code execution inside the renderer sandbox by convincing a victim to open a crafted HTML page in any Chrome build prior to 156.0.8078.47. User interaction (loading the malicious page) is the primary exploitation prerequisite, but no credentials or non-default configuration are needed, which is reflected in the CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Impact is contained by the sandbox boundary - absent a separate sandbox-escape chain the attacker does not obtain host-level code execution - and no public exploit code or confirmed active exploitation was identified at time of analysis; Google credits an internal Chrome security team address (chrome-cve-admin@google.com) as the reporter, and a vendor patch exists.
Out-of-bounds read in Google Chrome's Focus handling prior to 156.0.8078.47 can be triggered by a crafted HTML page and may allow arbitrary code execution inside the renderer sandbox. The issue is remotely reachable without credentials but requires user interaction, since the victim must load attacker-controlled web content; CVSS 8.8 reflects high confidentiality and integrity impact with unchanged scope. No public exploit code or CISA KEV entry was identified at time of analysis, and Google has released Chrome 156.0.8078.47 to address it.
Memory corruption in Google Chrome's browser API handling allows remote code execution inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation is unauthenticated from the network but requires user interaction, since the target must navigate to or render attacker-controlled content; successful abuse yields high confidentiality, integrity, and availability impact within the sandboxed renderer rather than at the host level. A vendor patch is available in 156.0.8078.47, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in the Blink DisplayLocking component of Google Chrome allows remote attackers to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R), and because the sandbox is unchanged (S:U), code execution is confined to the renderer - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, but the flaw is rated High by Chromium and the vendor has released a fixed build, making it a high-priority patch item for any environment running Chrome.
A use-after-free in Google Chrome's 'Actor' component allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. The flaw affects Chrome desktop builds prior to 156.0.8078.47 and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - network-reachable, low complexity, and requiring no authentication, but gated by user interaction since the victim must actively visit or load the attacker's page. Impact is explicitly bounded by Chrome's sandbox (Scope:Unchanged), so host-level compromise would require chaining a separate sandbox escape; no public exploit code or confirmed active exploitation was identified at the time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's Compositing component allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in a build prior to 156.0.8078.47. The issue is unauthenticated from the network perspective but requires user interaction (UI:R), and the independent assessment bounds impact to sandbox code execution because scope is Unchanged; host compromise would require chaining a separate sandbox escape. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis.
Use-after-free in Chrome's SiteIsolation component allows a remote attacker who convinces a victim to load a crafted HTML page to corrupt renderer memory and potentially execute arbitrary code at the privilege of the renderer process in any Chrome build prior to 156.0.8078.47. Unauthenticated attackers need only user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but the impact is scope-limited: because the flaw lives in sandboxed renderer code, host-level compromise requires chaining a separate sandbox-escape bug, which is why Google rates the issue only Chromium severity Medium despite the high base score. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis and the bug is not in CISA KEV, so risk is real but conditional on user browsing behavior rather than opportunistic scanning.
Use-after-free in Google Chrome's DevTools component (all versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the browser sandbox by convincing a victim to load a crafted HTML page that drives the vulnerable DevTools code path. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects low attack complexity and no privileges required, tempered only by the mandatory user interaction of visiting the attacker's page and by the fact that execution is confined to the renderer sandbox - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium security severity as Medium despite the high CVSS base score.
Use-after-free in Google Chrome's Media component on Windows (versions prior to 156.0.8078.47) allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so host-level compromise would require a separate sandbox-escape chain; Chromium rates the issue Low despite high CVSS impact metrics. A vendor patch is available, and no public exploit code was identified at time of analysis.
Use-after-free in Google Chrome's Input component before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and no privileges, but code execution is confined to Chrome's sandbox, so a separate sandbox escape is needed for OS-level compromise. No public exploit identified at time of analysis, no confirmed active exploitation, and a vendor patch is available.
Use-after-free in Google Chrome's Chromoting (Chrome Remote Desktop) component allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page on builds prior to 156.0.8078.47. Exploitation is gated by mandatory user interaction (the victim must navigate to attacker-controlled content) and the resulting code execution is confined to the sandbox, which is why Chromium assigned the issue a Low security severity; our independent assessment likewise rates confidentiality, integrity and availability impact as Low rather than the 8.8 base score published in other feeds. No public exploit code or confirmed active exploitation was identified at time of analysis, and no KEV listing applies.
A use-after-free in Chrome's Media component (CWE-416) lets a remote attacker who convinces a victim to open a crafted HTML page execute arbitrary code within the renderer sandbox on any Chrome build prior to 156.0.8078.47. Exploitation requires user interaction (UI:R) but no authentication or privileges (PR:N), and default configurations are exposed, giving the flaw an 8.8 CVSS rating; Google rates Chromium security severity as Medium because the resulting code execution is confined to the sandbox, and reaching the host would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though the vendor has released a patched build.
Sandbox-confined arbitrary code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component affects versions prior to 156.0.8078.47; a remote, unauthenticated attacker can trigger it only if a victim opens a crafted HTML page (UI:R). Chromium rates the flaw Low, and no public exploit or CISA KEV entry was identified at time of analysis, so NVD's 8.8 score overstates risk: execution does not escape the browser sandbox, and our assessment is C:L/I:L/A:L. Updating to 156.0.8078.47 or later removes the flaw.
Memory corruption in Google Chrome's Chromoting component (Chrome Remote Desktop) prior to 156.0.8078.47 allows an unauthenticated remote attacker to potentially execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Successful exploitation requires user interaction, and code execution is confined within the sandbox, so host-level compromise would require chaining a separate sandbox-escape vulnerability that this CVE does not provide. Chromium rates the issue Low despite NVD's 8.8 score, and no public exploit was identified at time of analysis; a vendor patch is available.
Improper input validation in Google Chrome's Bluetooth implementation (CWE-20) prior to 156.0.8078.47 allows a remote attacker to achieve arbitrary code execution inside the browser sandbox when a victim navigates to a crafted HTML page. The flaw is unauthenticated and network-reachable (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but requires user interaction, and the vendor explicitly confines the resulting code execution to the sandbox, so full host compromise would require a separate sandbox escape. Chromium rates the issue Medium severity, no public exploit code or CISA KEV confirmation was identified at time of analysis, and a vendor patch is available in Chrome 156.0.8078.47.
Memory corruption in Google Chrome's V8 JavaScript engine before 156.0.8078.47 lets remote, unauthenticated attackers execute arbitrary code inside Chrome's sandbox when a victim opens a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects high confidentiality, integrity, and availability impact but requires user interaction, and the code execution is sandbox-contained, so host compromise would require a separate sandbox-escape exploit. A vendor patch is available in 156.0.8078.47, and no public exploit code was identified at time of analysis.
Memory corruption in Google Chrome's Core component allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page in any desktop build prior to 156.0.8078.47. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) reflects low-complexity exploitation gated only by the user-interaction requirement, with sandbox containment (S:U) meaning a standalone compromise yields renderer-level code execution rather than direct host takeover. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied in the source feed; Google rates the flaw Medium under its own Chromium severity scale, and a vendor patch is available.
Use-after-free in Google Chrome's V8 JavaScript engine (versions prior to 156.0.8078.47) allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is rated CVSS 3.1 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting network reachability, low complexity, no privileges, and required user interaction; code execution is confined to the sandbox, so OS compromise would require an additional sandbox escape. A vendor-released patch is available as version 156.0.8078.47, and no public exploit has been identified at time of analysis.
Use-after-free in Google Chrome's Extensions component before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so full host compromise would require a separate sandbox-escape vulnerability; the vendor rates this Chromium security severity Medium while the supplied CVSS score is 8.8. No public exploit identified at time of analysis.
A use-after-free in Chrome's Actor component affects versions prior to 156.0.8078.47, allowing remote code execution inside the browser sandbox when a victim loads a crafted HTML page. Exploitation is not zero-click: the CVSS vector (UI:R, PR:N) requires the target to navigate to or render attacker-controlled content in a default configuration, and no public exploit code or CISA KEV confirmation is available at time of analysis. Because the flaw yields code execution only within the sandbox, it must be chained with a separate sandbox escape to fully compromise the host.
Remote code execution in Google Chrome's Proxy component (versions before 156.0.8078.47) stems from improper input validation that can be triggered when an unauthenticated remote attacker convinces a victim to load a crafted HTML page. Exploitation requires user interaction (UI:R) and yields code execution confined within the browser sandbox; no public exploit was identified at time of analysis.
Use-after-free in Google Chrome's Bookmarks component (all builds prior to 156.0.8078.47) allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is unauthenticated from the network side but requires user interaction - the victim must visit or render the malicious page - and the resulting code execution is confined to Chrome's renderer sandbox, so full OS compromise would require chaining a separate sandbox-escape flaw. Google rates the underlying Chromium issue as Low severity, and no public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 base score of 8.8 reflects the memory-corruption impact class rather than a demonstrated attack in the wild.
Sandboxed code execution in Google Chrome versions prior to 156.0.8078.47 is possible through a use-after-free flaw in the WindowControlsOverlay component, which a remote, unauthenticated attacker can trigger by convincing a victim to open a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation yields arbitrary code execution, but strictly within the renderer sandbox - the attacker gains no direct access to the host operating system without chaining a separate sandbox-escape bug, which is why Google rates the issue only Medium in its own severity scheme. Google has shipped a vendor fix in Chrome 156.0.8078.47; no public exploit code or confirmed active exploitation was identified at time of analysis, and the attack is not drive-by - it requires deliberate user navigation to attacker-controlled content.
Memory corruption in Google Chrome's Transactions Platform component (desktop builds prior to 156.0.8078.47) lets remote attackers potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because the malicious page can fully compromise the confidentiality, integrity and availability of the sandboxed browser process. Affected users are those running any Chrome version below 156.0.8078.47 in its default configuration; exploitation is unauthenticated but requires the victim to navigate to attacker-controlled content. There is no CISA KEV entry and no public exploit identified at time of analysis, and Google has released a vendor patch in the 156.0.8078.47 stable-channel update, though Chrome's automatic update mechanism also narrows the realistic exposure window and limits this to a patch-priority issue rather than an emergency.
Out-of-bounds read in Google Chrome's Navigation component allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox by getting a victim to load a crafted HTML page on any build prior to 156.0.8078.47. The only real prerequisite is user interaction (UI:R) - a default desktop install is exposed, no authentication or special configuration is needed, so the practical risk concentrates on endpoints with delayed or disabled auto-updates. There is no public exploit identified at time of analysis and no KEV listing; Google shipped the fix in the Stable channel build 156.0.8078.47, and the Chromium team self-rated the issue Medium despite an 8.8 vector score.
Memory corruption in Chrome's Bluetooth component affects all builds prior to 156.0.8078.47 and lets a remote attacker achieve code execution inside the browser sandbox by convincing a victim to open a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N), and any code that runs is contained by the Chrome sandbox - turning it into host compromise would require chaining a separate sandbox escape not covered by this CVE. No public exploit code or CISA KEV entry is reported in the available data, and a vendor patch shipping in Chrome 156.0.8078.47 addresses the flaw; Chromium rates it Medium security severity despite the 8.8 CVSS score.