Memory corruption in Google Chrome's ANGLE graphics layer on Windows before 156.0.8078.47 enables remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and no authentication, and because the impact is sandbox-limited (S:U), an attacker would need a separate sandbox-escape flaw to compromise the host. Vendor patches are available in Chrome 156.0.8078.47, and no public exploit was identified at time of analysis.
Memory corruption in Chrome's XML handling allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page; the flaw affects Google Chrome desktop builds prior to 156.0.8078.47 and requires user interaction (the page must be loaded or rendered), with no authentication needed. Google rates the Chromium security severity as High and lists the issue privately in its tracker, and the vendor has released 156.0.8078.47 as the fixed build. Impact is bounded by the renderer sandbox: because the CVSS scope is Unchanged, code execution is confined to the sandboxed process and full host compromise would additionally require a separate sandbox-escape bug. No public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary code execution inside the Chrome renderer sandbox on macOS is possible with Google Chrome versions prior to 156.0.8078.47 when a user opens a crafted HTML page. The flaw is a use-after-free in Views rated CVSS 3.1 8.8 (High; AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), requiring user interaction but no authentication; code execution is confined to the renderer unless chained with a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Memory corruption in Google Chrome's SiteIsolation component affects desktop builds prior to 156.0.8078.47 and allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page (CVSS 8.8, UI:R). Impact is confined to the renderer sandbox under Scope:Unchanged, so full host compromise requires chaining a separate sandbox-escape vulnerability; no public exploit code was identified at time of analysis, and Google has released a fixed build.
A use-after-free in Google Chrome's Extensions component (CWE-416) affects all builds prior to 156.0.8078.47 and lets a remote attacker run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting low complexity and no authentication requirement but a mandatory user-interaction step; impact is confined to the sandbox, so host-level compromise would require chaining a separate sandbox escape. There is no CISA KEV listing and no public exploit code identified at time of analysis, and Google rates the Chromium security severity as Medium.
Use-after-free in Google Chrome's API layer prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The CVSS 3.1 vector (8.8) confirms network reachability and no privileges required, but exploitation is not zero-click: it requires user interaction to render the crafted page, and the impact is scope-limited to Chrome's sandbox (S:U). Google has released a fixed build, and no public exploit code was identified at time of analysis.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the ReadingMode component of Google Chrome builds prior to 156.0.8078.47, triggered when a victim opens a crafted HTML page. The flaw is unauthenticated from the network perspective but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and Google's own Chromium severity rating for this issue is Low - a sharp conflict with the 8.8 base score that materially changes how the risk should be weighed. Because the description confines the code execution to the sandbox, a complete host compromise would require chaining a separate sandbox-escape bug that this CVE does not supply; no public exploit was identified at the time of analysis, and a vendor patch is available in Chrome 156.0.8078.47.
Memory corruption in ANGLE, the graphics translation layer used by Google Chrome, allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page in any Chrome build prior to 156.0.8078.47. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms no credentials or special privileges are needed, but exploitation hinges on the user interaction metric - the target must actually visit or render the attacker-supplied content - and the impact is explicitly bounded to the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at the time of analysis, and Google has released Chrome 156.0.8078.47 to address the defect (Chromium severity: High).
Memory corruption in the Extensions component of Google Chrome before version 156.0.8078.47 allows remote code execution inside the browser sandbox when a victim opens a crafted HTML page, requiring user interaction (UI:R) but no authentication (PR:N). Successful exploitation is confined to the sandboxed renderer/extension process (S:U), so full host compromise would require a separate sandbox-escape flaw; this is why Chromium rates the issue Medium despite a CVSS 3.1 base score of 8.8. A vendor patch is available in Chrome 156.0.8078.47, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in Chrome for iOS versions prior to 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim navigates to a crafted HTML page. Exploitation requires user interaction and the code execution is confined to the sandbox, so full host compromise would require chaining a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis. The vendor rated the issue Low (likely reflecting the sandbox confinement), while the NVD CVSS 3.1 base score is 8.8 High.
Memory corruption in Google Chrome's video handling allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must visit or render the attacker-controlled page - and no special configuration is needed on default installations. No public exploit code was identified at time of analysis, and because the resulting code execution is contained by the Chromium renderer sandbox, a separate sandbox-escape flaw would be required to compromise the underlying host, which is the main limiting factor on real-world severity despite the 8.8 CVSS base score.
Memory corruption in the Back/Forward Cache (BFCache) component of Google Chrome allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page on any Chrome build prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects low attack complexity and full confidentiality/integrity impact within the compromised renderer, but user interaction is mandatory and code execution remains contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape flaw that this CVE does not provide. No public exploit code or confirmed active exploitation was identified at time of analysis; Google rates the issue Chromium security severity Medium and has released a stable-channel fix.
Use-after-free in Google Chrome's Extensions component before 156.0.8078.47 lets unauthenticated remote attackers potentially execute arbitrary code inside the Chrome sandbox when a victim visits a crafted HTML page. Exploitation requires user interaction (UI:R), and the resulting code execution is confined to the sandbox, so host-level compromise would require chaining with a separate sandbox escape. No public exploit was identified at time of analysis, but the vendor has released a fixed build and the issue should be treated as a high-priority patch item.
Memory corruption in the Core component of Google Chrome versions prior to 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, base 8.8) reflects a drive-by profile: no authentication or special configuration is required, but exploitation hinges on user interaction (UI:R), and the description explicitly confines code execution to 'inside the sandbox' - so an attacker remains limited to the renderer process and would need a chained sandbox escape to affect the underlying OS. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis, and Chromium's own severity rating for this issue is Low despite the 8.8 base score.
Memory corruption in Google Chrome's Chromoting (Chrome Remote Desktop) component before 156.0.8078.47 can allow a remote, unauthenticated attacker to potentially execute code inside Chrome's sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction, and the assessed impact is limited to low confidentiality, integrity, and availability because code execution is contained by the browser sandbox unless chained with a separate sandbox escape. No public exploit identified at time of analysis, no CISA KEV active exploitation is indicated in the supplied data, and Google has released a fixed build.
Memory corruption in Google Chrome's media handling before version 156.0.8078.47 can let a remote attacker potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The issue is rated CVSS 8.8 with user interaction required, and successful exploitation is confined to the sandbox, so full host compromise would require an additional sandbox escape. No CISA KEV listing or public exploit was identified at time of analysis, and no public exploit identified at time of analysis.
Use-after-free in Google Chrome's Permissions component allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page on any Chrome build prior to 156.0.8078.47. No authentication or privileges are required, though exploitation is not zero-click (UI:R) and the resulting code execution is contained within the Chrome sandbox - full host compromise would require chaining a separate sandbox-escape flaw. Chromium rates the bug Low severity, but the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (156.0.8078.47) is available.
Code execution inside the renderer sandbox is possible through memory corruption in Google Chrome's DevTools before 156.0.8078.47, triggered when an unauthenticated remote attacker convinces a victim to load a crafted HTML page. The assessed CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, reflecting mandatory user interaction and sandbox containment, which is lower than the NVD-style 8.8 score. No public exploit identified at time of analysis, and Google has released a fixed build.
Google Chrome for iOS before 156.0.8078.47 fails to properly validate input in its Mobile component, allowing a remote, unauthenticated attacker who convinces a user to open a crafted HTML page to achieve arbitrary code execution inside the browser's sandbox. Successful exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) and is confined to the sandbox boundary, so it does not by itself imply full device compromise; Google rates the underlying issue as Chromium security severity Medium, a notable gap from the 8.8 base score. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and our independent assessment holds that the paper signals are moderate-to-strong while real-world urgency remains tempered.
Google Chrome releases before 156.0.8078.47 contain a memory-corruption flaw in the FileSystem component that can be triggered when a victim opens an attacker-controlled HTML page. Exploitation may permit arbitrary code execution inside Chrome's renderer sandbox, though full system compromise would require chaining a separate sandbox escape; the attack is network-reachable and unauthenticated but requires user interaction. No public exploit was identified at time of analysis, and Google has published fixed build 156.0.8078.47.
Memory corruption in the DevTools component of Google Chrome lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page in any build prior to 156.0.8078.47. The CVSS vector requires no privileges (PR:N) but does require user interaction (UI:R), and the resulting code execution is contained by Chrome's sandbox, so host or OS compromise would need a separate sandbox-escape chain. Google assigns only a Low Chromium severity even though the published base vector reads 8.8, and our assessment (C:L/I:L/A:L) reflects the sandbox containment; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Memory corruption in Google Chrome's DevTools component (versions prior to 156.0.8078.47) allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim opens an attacker-crafted HTML page. No authentication is required, but exploitation hinges on user interaction (UI:R), and because the CVSS scope is unchanged (S:U), the impact is confined to the renderer sandbox rather than a full host compromise - chaining a separate sandbox escape would be required to break out. Signals conflict and must be read together: NVD-style scoring is 8.8 while Google rates the Chromium security severity as Low, no public exploit code was identified at time of analysis, there is no CISA KEV entry, and the vendor has released a fixed build (156.0.8078.47).
Sandbox-confined code execution in Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who convinces a victim to open a crafted HTML page trigger improper input validation in the browser's UI layer and potentially run arbitrary code inside the renderer sandbox. No privileges are required (PR:N), but the attacker cannot act without the victim actively loading the page (UI:R), and any code that does run is contained by Chrome's sandbox - escaping to the host would require a separate, unrelated sandbox-escape flaw. The issue carries a notably conflicting risk profile: the raw 8.8 base score contrasts with Google's 'Low' Chromium severity rating and with our assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, and no public exploit has been identified at time of analysis even though the fix is already shipping.
Memory corruption in Google Chrome's DOM implementation (CWE-119) affects desktop builds prior to 156.0.8078.47 and lets a remote, unauthenticated attacker corrupt memory by getting a victim to open a crafted HTML page, with the potential for arbitrary code execution. Exploitation is gated by mandatory user interaction (CVSS UI:R) and the resulting code execution is confined to the renderer sandbox (S:U); reaching the host operating system would require chaining a separate sandbox-escape flaw, which materially lowers real-world severity despite the 8.8 base score. Google has released a fixed build and no public exploit code was identified at time of analysis.
Memory corruption in ANGLE, the graphics translation layer Chrome uses to map OpenGL ES calls onto Direct3D on Windows, allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox on Chrome for Windows versions prior to 156.0.8078.47. Exploitation requires the victim to open or navigate to a crafted HTML page (UI:R) and no authentication or privileges are needed (PR:N); the payoff is confined to the renderer process, so host compromise would require chaining a separate sandbox escape. Google rates the issue High severity and has released a fixed build; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the flaw is a credible high-priority patch target for Windows Chrome fleets.
Use-after-free in the Chromecast component of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who persuades a victim to open a crafted HTML page potentially execute arbitrary code - but only inside the browser sandbox, as confirmed by the vendor's own wording. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting a high-confidentiality and high-integrity impact that requires user interaction; there is no fully drive-by, zero-interaction path, and no public exploit code or CISA KEV entry was identified at time of analysis. Because code execution stays within the sandbox, host compromise would require a separate sandbox-escape primitive, which is the main factor capping real-world impact.
Use-after-free in Google Chrome on iOS before 156.0.8078.47 enables remote attackers to execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (the victim must navigate to the page), and code execution is confined to the sandbox, so full-device compromise would need an additional sandbox escape. Google has released a vendor patch; no public exploit code or active exploitation was identified at time of analysis.
Memory corruption in the Contacts component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page, affecting builds prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms this is an unauthenticated drive-by profile that hinges entirely on user interaction - the victim must navigate to attacker-controlled content, and nothing triggers passively on the server side. Impact is bounded by Chrome's renderer sandbox: code execution occurs inside the sandbox, so full host compromise would require chaining a separate sandbox-escape bug; no public exploit code was identified and the flaw is not in CISA KEV at time of analysis.
Use-after-free memory corruption in Google Chrome's DataTransfer interface affects builds prior to 156.0.8078.47 and lets a remote attacker execute arbitrary code within the renderer sandbox by convincing a victim to load a crafted HTML page. No public exploit code or confirmed active exploitation is identified in the available intelligence, though the vendor rates the issue Medium severity while the CVSS 3.1 vector scores 8.8 (AV:N/AC:L/PR:N/UI:R/S:U). Because the sandbox confines execution, full host compromise would require chaining an additional sandbox-escape vulnerability, so practical risk centers on renderer-level compromise, data theft from the browsing session, and denial of service.
Use-after-free in Google Chrome's Navigation component allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting all Chrome builds prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R), since the target must actively visit the attacker-controlled page, and the resulting code execution is confined to the renderer sandbox - escaping to the host would require an additional sandbox-escape vulnerability. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has released a fixed build (156.0.8078.47), so real-world urgency is lower than the raw 8.8 base score implies.
Use-after-free in Google Chrome's Extensions component (versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The vendor rates the issue Low severity, and the independent assessment scores it 6.3 with limited confidentiality, integrity, and availability impact because code execution is confined to the sandbox; no public exploit code or active exploitation has been identified, and a vendor patch is available.
Improper input validation in Google Chrome's FullScreen implementation before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page. The score picture is contradictory and must be read carefully: NVD's CVSS 3.1 vector rates this 8.8 (High, AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H) while Google's Chromium security team assigned it a 'Low' severity, reflecting that the resulting code execution is expected to be contained by the sandbox and that exploitation requires user interaction (the victim must load the attacker's page). No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and only desktop Chrome builds prior to 156.0.8078.47 are affected; the vendor has released a fixed version.
Memory corruption in the DevTools component of Google Chrome desktop builds prior to 156.0.8078.47 allows a remote attacker who convinces a victim to open a crafted HTML page to run arbitrary code within the browser sandbox. Although Google rates the Chromium security severity as Low, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8 because successful exploitation yields high confidentiality, integrity and availability impact inside the sandboxed renderer; no authentication is needed but user interaction (opening the page) is required. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is tempered by the need for a separate sandbox-escape chain to reach the host.
Use-after-free in ANGLE, Chrome's WebGL/graphics translation layer, allows remote attackers to execute arbitrary code inside the renderer sandbox on Windows by luring a victim into opening a crafted HTML page. Exploitation requires user interaction (UI:R) - a page that drives the WebGL/GPU rendering path - and affects Chrome builds on Windows earlier than 156.0.8078.47; unauthenticated remote delivery is possible (PR:N) and default installations are exposed because ANGLE is the standard graphics backend. Code execution is confined to the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw; no public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the issue High severity with a vendor patch available.
Use-after-free in Google Chrome's ContextualSearch component (all versions prior to 156.0.8078.47) allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a low-complexity, network-reachable flaw whose only prerequisite is victim navigation; however, per the vendor description, the resulting code execution is confined to the renderer sandbox, so host-level compromise requires a separate sandbox-escape vulnerability. Chromium rates this a Medium-severity issue, no public exploit code was identified at time of analysis, and it is not listed in CISA KEV.
Memory corruption in the Omnibox component of Google Chrome before 156.0.8078.47 allows an unauthenticated remote attacker to execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (UI:R) and remains confined to the sandbox, so host-level compromise would require a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor rates the Chromium security severity as Medium.
Remote code execution inside the renderer sandbox affects Google Chrome builds prior to 156.0.8078.47, where a use-after-free in the Variations component can be triggered by a crafted HTML page. Exploitation requires the victim to navigate to attacker-controlled content (UI:R), but no authentication or special configuration is needed; the resulting code execution is confined to the sandbox, so crossing a security boundary depends on chaining a separate sandbox-escape flaw. No public exploit code was identified at time of analysis.
Use-after-free in Google Chrome's Extensions subsystem before 156.0.8078.47 lets unauthenticated remote attackers execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page, with high confidentiality and integrity impact under CVSS 8.8. No public exploit identified at time of analysis, and exploitation is constrained by the required user navigation and by the renderer sandbox, so host compromise would require chaining a separate sandbox escape. Google has released a vendor patch in Chrome 156.0.8078.47.
Use-after-free in the Forms component of Google Chrome before 156.0.8078.47 allows a remote, unauthenticated attacker to achieve arbitrary code execution, but only inside the renderer sandbox, by convincing a victim to load a crafted HTML page containing malicious form markup or JavaScript. Exploitation requires user interaction (CVSS UI:R) and low complexity, and the CVSS 8.8 rating reflects high confidentiality, integrity, and availability impact within the compromised renderer rather than on the host OS; escaping Chrome would require chaining a separate sandbox-escape flaw. Vendor patch 156.0.8078.47 is available, and no public exploit code or CISA KEV confirmation was identified at time of analysis. Note the reported Medium Chromium severity contrasts with the 8.8 NVD-style vector, which should guide prioritization toward prompt patching rather than emergency response.
Improper input validation in the Downloads component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a user to load a crafted HTML page (CVSS UI:R, PR:N) achieve arbitrary code execution, though only within the renderer sandbox - full host compromise would require chaining a separate sandbox escape. Google rates the issue Medium (Chromium severity), while the CVSS 3.1 vector scores 8.8 due to high confidentiality and integrity impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Memory corruption in the Core component of Google Chrome desktop builds prior to 156.0.8078.47 lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). No authentication or non-default configuration is needed - the only prerequisite is that the user loads the malicious page in an unpatched browser. There is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the resulting code execution is confined to the renderer sandbox, full host compromise would require chaining a separate sandbox-escape flaw; Google has shipped a stable-channel fix, making this a patch-priority item rather than an emergency one.
Memory corruption in the V8 JavaScript engine allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the browser's renderer sandbox by convincing a victim to load a crafted HTML page in Google Chrome versions prior to 156.0.8078.47 (desktop and ChromeOS). Exploitation requires user interaction (the victim must open the malicious page), and because the CVSS scope is unchanged, the resulting compromise is confined to the renderer sandbox - full host takeover realistically requires chaining with a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, though the engine-level memory corruption primitive, the high CVSS score of 8.8, and Chrome's status as a high-value mass-market target make this a priority patch item; Google credits the flaw as reported by chrome-cve-admin@google.com and rates it Chromium security severity High.
Memory corruption in Google Chrome's GPU component allows remote attackers to potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page in versions prior to 156.0.8078.47. Exploitation requires user interaction, and because the scope is unchanged the flaw does not by itself escape Chrome's sandbox or compromise the host operating system. No public exploit code or confirmed active exploitation was identified at time of analysis, though the vendor rates the issue High severity with a CVSS score of 8.8.
Use-after-free in Google Chrome's DOM allows a remote attacker to execute arbitrary code inside the browser sandbox by convincing a victim to load a crafted HTML page in versions prior to 156.0.8078.47. Exploitation requires user interaction, and the impact is confined to the renderer sandbox unless chained with a separate sandbox-escape flaw; Google rates the issue as Chromium security severity Medium despite the 8.8 CVSS score. Vendor-released patch: 156.0.8078.47, and no public exploit was identified at time of analysis.
Google Chrome's Extensions component before 156.0.8078.47 contains a memory-corruption flaw (CWE-119) that can lead to arbitrary code execution inside the browser sandbox when a victim loads a crafted HTML page; the vector requires user interaction (UI:R) but no authentication (PR:N), and scope remains unchanged. At CVSS 8.8 the flaw is high impact for confidentiality, integrity, and availability within the renderer, although sandbox confinement limits it to renderer-level execution unless a separate sandbox escape is chained. Risk signals are mixed and must be weighed carefully: a vendor patch exists in 156.0.8078.47, and no public exploit identified at time of analysis in the supplied intelligence.
Memory corruption in Google Chrome's Scheduling component (fixed in 156.0.8078.47) lets a remote attacker who convinces a victim to open a crafted HTML page potentially achieve arbitrary code execution inside the renderer sandbox. Exploitation is not passive: it requires user interaction (UI:R) such as visiting a malicious or compromised/ad-served page, and no authentication is needed (PR:N), so any standard desktop install below the fixed build is a candidate target. Severity signals conflict - Google's Chromium rating is Low and no public exploit code or CISA KEV entry exists at time of analysis, yet the NVD-style vector scores 8.8 because of full confidentiality/integrity/availability impact within the compromised renderer; real host compromise would additionally require chaining a separate sandbox escape.
Memory corruption in Google Chrome's FedCM (Federated Credential Management) component allows a remote attacker to potentially execute arbitrary code within the browser sandbox when a victim visits a crafted HTML page, affecting all Chrome versions prior to 156.0.8078.47. Exploitation requires user interaction (UI:R) and no authentication (PR:N), with publicly available patch details and vendor advisories published; no public exploit code or confirmed active exploitation is identified at time of analysis. Because code execution is contained inside the sandbox (S:U), impact is bounded - a separate sandbox-escape vulnerability would be required for host-level compromise.
Memory corruption in Google Chrome's Passwords component before 156.0.8078.47 lets remote attackers achieve arbitrary code execution inside the browser sandbox when a victim renders a crafted HTML page. The CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:N/UI:R) with high confidentiality, integrity, and availability impact, but Chromium rates the issue Low and the code execution is sandbox-confined; no public exploit identified at time of analysis.
Use-after-free in Google Chrome's Navigation component before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. Exploitation requires user interaction and, because code execution is confined to the sandbox, full host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation identified at time of analysis, and Google has released a fixed build.
Use-after-free in Chrome's Paint rendering component lets a remote attacker execute arbitrary code inside the renderer sandbox by getting a victim to open a crafted HTML page in any build prior to 156.0.8078.47. No privileges or credentials are needed, but the attacker must convince the user to render the malicious content (CVSS UI:R), and because the score is scoped to the renderer (S:U), full host compromise would additionally require a separate sandbox escape. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor has released a fixed build, so this is a genuine high-priority patch item for browser fleets rather than a theoretical memory-safety bug.