Use-after-free in Google Chrome's Editing component (all builds prior to 156.0.8078.47) allows an unauthenticated remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is gated entirely by user interaction - the target must visit or open the attacker-supplied page - and the resulting code execution is confined to the Chrome renderer sandbox, so full host compromise would require chaining a separate sandbox-escape bug; Google consequently rates the standalone issue as Chromium severity 'Low' even though the generic CVSS 3.1 vector scores 8.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was supplied, so the practical priority hinges on reconciling the high vector score with the sandbox-limited, interaction-dependent impact.
Memory corruption in the Chrome 'Model' component allows a remote attacker who convinces a victim to render a crafted HTML page to execute arbitrary code inside the browser's renderer sandbox in Chrome versions prior to 156.0.8078.47. No authentication is required, but exploitation depends on user interaction (the victim must visit or load the attacker-controlled page), and because the resulting code execution is confined to the sandbox, full host compromise would require chaining a separate sandbox-escape bug - which is why Google assigned this only a 'Low' Chromium security severity despite the 8.8 base score. No public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in the Extensions component of Google Chrome for Android before 156.0.8078.47 allows remote attackers to potentially achieve arbitrary code execution inside the browser sandbox by getting the victim to render a crafted HTML page. Exploitation requires the user to open a malicious page (UI:R) but no authentication or non-default configuration, so any default Android Chrome install below the fixed build is exposed; the payoff is confined to the renderer sandbox and would need a second, separate sandbox-escape bug to reach the Android OS or other apps. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium issue only Medium severity, making this a medium-to-high priority patching item rather than an emergency.
Use-after-free in Chrome's SiteIsolation component on Android allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page (UI:R required, PR:N). Only Android builds prior to 156.0.8078.47 are affected; the resulting code execution is confined to the sandboxed renderer, so full device compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though the vendor-rated severity combined with a high CVSS (8.8) and a memory-corruption/RCE tag profile makes prompt patching advisable; the vendor has released a fixed build.
Memory corruption in ContentCapture in Google Chrome for Android before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, although the CVSS 8.8 score conflicts with Google's Low Chromium severity and the stated sandbox containment. No public exploit code or active exploitation is identified at time of analysis, and Google has released a fixed build, 156.0.8078.47. The high CVSS versus Low vendor severity and sandbox-limited impact are conflicting signals that should be reconciled during triage.
Arbitrary code execution inside the Chrome renderer sandbox on Android is possible in Google Chrome for Android versions prior to 156.0.8078.47 when a victim loads a crafted HTML page, stemming from improper input validation in the UI (CWE-20). The issue is remotely triggerable without authentication (PR:N) but requires user interaction (UI:R), and the assessed scope is unchanged (S:U), so code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium security severity Low despite the 8.8 CVSS base score, a vendor patch (156.0.8078.47) is available, and no public exploit identified at time of analysis.
Memory corruption in the History component of Google Chrome for Android (versions prior to 156.0.8078.47) lets a remote attacker who persuades a victim to load a crafted HTML page execute arbitrary code, though the impact is bounded by the renderer sandbox. The flaw is unauthenticated from the attacker's perspective and requires only that the target browse attacker-controlled content (CVSS 8.8, UI:R), meaning it can be triggered through ordinary web browsing or a redirect chain. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has released a stable-channel fix in 156.0.8078.47.
Memory corruption in the Voice component of Chrome for Android allows a remote attacker who convinces a victim to open a crafted HTML page to execute arbitrary code inside the renderer sandbox, and Google has addressed it in the 156.0.8078.47 stable release. The vendor's Medium rating reflects containment: exploitation yields code execution within the sandbox (S:U), so reaching the host OS or other apps would require chaining a separate sandbox-escape flaw, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The attack is unauthenticated but requires user interaction (UI:R), which limits scalability compared with a zero-click flaw.
Use-after-free in Google Chrome's Glic component (versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker (PR:N) to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (UI:R) such as visiting a malicious or compromised site. The impact is scope-unchanged (S:U): code execution is confined to the Chrome renderer sandbox, and achieving host-level compromise would require chaining a separate sandbox-escape vulnerability. Available intelligence shows no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation; Google has released a vendor patch in Chrome 156.0.8078.47.
Memory corruption in Google Chrome's Canvas rendering path affects desktop and ChromeOS builds prior to 156.0.8078.47, allowing a remote, unauthenticated attacker to potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (UI:R) to open the crafted page, and the CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact within the renderer sandbox; no public exploit identified at time of analysis and no CISA KEV listing was provided. Google has released a vendor patch in version 156.0.8078.47.
Memory corruption in Chrome's SiteIsolation component lets a remote attacker who convinces a user to open a crafted HTML page potentially execute arbitrary code inside the browser sandbox on Chrome builds prior to 156.0.8078.47. Exploitation is not silent or wormable: the CVSS vector AV:N/AC:L/PR:N/UI:R means no credentials are needed but victim interaction is mandatory, and the vendor scopes the outcome to code execution 'inside the sandbox,' so full host compromise would require chaining a separate sandbox-escape flaw. Google rates the underlying bug Medium severity while the derived CVSS base score is 8.8; no public exploit code or active exploitation is identified in the available intelligence at time of analysis, and a vendor patch (156.0.8078.47) is already published.
Memory corruption in the SignIn component of Google Chrome releases prior to 156.0.8078.47 lets a remote, unauthenticated attacker potentially execute arbitrary code - but only inside the renderer sandbox - after convincing a victim to open a crafted HTML page. Google's Chromium team rated this 'Low' severity even though the CVSS 3.1 base score is 8.8, because the corruption yields in-sandbox code execution and host compromise would require chaining a separate sandbox escape. No public exploit code has been identified and the issue is not in CISA KEV, although the vendor has already shipped a fixed build; the conflict between the high numeric score and the Low vendor rating is the main judgement call for prioritisation.
Memory corruption in Google Chrome's Bindings component before 156.0.8078.47 allows remote, unauthenticated attackers to potentially achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (UI:R) and is constrained by Chrome's sandbox, so full host compromise would need a separate sandbox-escape flaw; no public exploit code was identified at time of analysis, and the vendor rates the issue Chromium severity Medium despite an 8.8 CVSS score.
Memory corruption in the FullScreen component of Google Chrome prior to 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not zero-click: per the UI:R metric the victim must visit or be directed to attacker-controlled content that exercises the FullScreen code path, after which a successful heap/out-of-bounds style corruption can yield code execution at the renderer's privilege level. Impact is bounded by Chrome's sandbox (S:U), so a standalone exploit does not by itself reach the host operating system and would need a separate sandbox-escape flaw for full post-exploitation; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though Google rated it Chromium security severity Medium and has shipped a fixed build. The practical risk is drive-by web compromise of unpatched desktop fleets, session cookie/credential theft from within the browser, and chaining with a sandbox escape in targeted campaigns.
Memory corruption in Google Chrome's PerformanceAPIs component before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (UI:R) but no authentication (PR:N), so default desktop installations are exposed; the 8.8 CVSS score reflects high confidentiality, integrity, and availability impact, although Scope Unchanged means host compromise would require chaining with a separate sandbox escape, and Chromium rated the issue Medium. Vendor patches are available in Chrome 156.0.8078.47, and no public exploit or CISA KEV active-exploitation signal was identified at time of analysis.
Google Chrome before 156.0.8078.47 contains a use-after-free in its Transactions Platform that allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction but no privileges or non-default configuration, so default installations are in scope; code execution is sandbox-confined unless chained with a separate sandbox escape. No public exploit identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fixed version.
Use-after-free memory corruption in ANGLE, Chrome's OpenGL ES abstraction layer, allows remote attackers to execute arbitrary code inside the renderer sandbox in Google Chrome versions prior to 156.0.8078.47 when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated from the network but requires mandatory user interaction to render the malicious content, and the resulting code execution is contained by Chrome's renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw; Google rates the Chromium security severity as Low, which is consistent with that containment. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied; a vendor patch is available in Chrome 156.0.8078.47.
Memory corruption in Google Chrome DevTools before 156.0.8078.47 can let a remote, unauthenticated attacker execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page and then engages DevTools against it. Exploitation is constrained by required user interaction and the fact that DevTools is a developer feature not active during routine browsing; our adjusted assessment raises attack complexity to High, so despite the headline CVSS 8.8 the real-world priority is moderate. No public exploit identified at time of analysis.
Memory corruption in the ANGLE graphics translation layer of Google Chrome on Windows allows remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page, affecting versions prior to 156.0.8078.47. The attack requires user interaction (UI:R) but no authentication, and default Chrome configurations are exposed because ANGLE is the standard WebGL/graphics backend. Code execution is confined to the Chrome sandbox, so host compromise would require chaining with a separate sandbox escape; no public exploit has been identified at time of analysis, and a vendor patch is available in 156.0.8078.47.
Memory corruption in Google Chrome's PlatformIntegration component allows remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page, affecting Chrome versions prior to 156.0.8078.47. Exploitation requires user interaction but no authentication, and the CVSS 3.1 score is 8.8; however, code execution is confined within the sandbox unless the attacker chains a separate sandbox-escape vulnerability. No public exploit was identified at time of analysis, and Google has released a patched stable-channel build.
Memory corruption in the DevTools component of Google Chrome builds prior to 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the Chrome sandbox when a victim opens a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms no authentication is required, but exploitation hinges on user interaction (UI:R), and code execution is confined to the renderer sandbox unless chained with a separate sandbox-escape flaw. No public exploit code or CISA KEV active-exploitation entry is in the available data, and Chromium rated the underlying security severity as Low despite the 8.8 CVSS base score.
Memory corruption in Google Chrome's Bluetooth implementation before version 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox by convincing a user to open a crafted HTML page. Exploitation requires user interaction to load the page (CVSS UI:R), and because the assessed scope is unchanged, compromise of the host operating system or other origins would require a separate sandbox-escape vulnerability. No public exploit code or CISA KEV listing was identified at the time of analysis, but the vendor has released Chrome 156.0.8078.47 to correct the flaw.
Google Chrome before 156.0.8078.47 contains a use-after-free in the Actor component that allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and the impact is sandbox-confined rather than host-level code execution unless a separate sandbox escape is chained. The vendor has released Chrome 156.0.8078.47, Chromium rated the issue Low, and no public exploit was identified at time of analysis; the supplied 8.8 base score conflicts with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L vector.
Memory corruption in the DevTools component of Google Chrome desktop builds prior to 156.0.8078.47 allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the Chrome renderer sandbox by convincing a victim to open a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). The required user interaction and the fact that execution is confined within the sandbox - no sandbox escape or host compromise was demonstrated - are the key limiting factors, which is why Chromium assigned this a security severity of Low despite the high base score. No public exploit code or confirmed active exploitation was identified in the available intelligence, and EPSS data was not provided, so real-world risk should be treated as contextual rather than demonstrated; signals conflict and must be weighed carefully, since the high CVSS and RCE tag coexist with a Low vendor severity and sandbox confinement. Fixed builds are available from the vendor in Chrome 156.0.8078.47 and later.
Memory corruption in Google Chrome's DataTransfer component can potentially allow a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page in a build prior to 156.0.8078.47. The CVSS 8.8 rating reflects high confidentiality and integrity impact, but exploitation requires user interaction (UI:R) and does not by itself escape the renderer sandbox (S:U), so host-level compromise would require a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, and Google has released a fixed build, 156.0.8078.47.
Use-after-free in Google Chrome's GPU component allows remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page; all Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires only that a user navigate to attacker-controlled content (no authentication, default configurations exposed). Successful exploitation yields high confidentiality and integrity impact but remains scope-unchanged - code executes inside the renderer/GPU sandbox, so host compromise requires chaining a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium severity as Medium even though the CVSS base score computes to 8.8. A vendor-released patch in Chrome 156.0.8078.47 is available.
Remote code execution inside Chrome's renderer sandbox is possible in Google Chrome versions prior to 156.0.8078.47 through crafted HTML that exercises the Media component. The CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:N/UI:R), so exploitation is remote and unauthenticated but requires the victim to load attacker-controlled content; impact is confined to the sandbox and host compromise would require a separate sandbox escape. Google has released the fixed 156.0.8078.47 build, and no public exploit identified at time of analysis; Chromium rates the issue Medium despite the High CVSS score.
Use-after-free in Chrome's Network component on Windows lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the browser sandbox. All Windows Chrome builds prior to 156.0.8078.47 are affected; exploiting it requires user interaction (rendering attacker-controlled content) but no credentials, and the resulting code execution is contained by the sandbox, so full host compromise needs chaining with a separate sandbox escape. Google rates it High severity and a fixed build is available; no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper input validation in the ANGLE graphics translation layer shipped with Google Chrome on macOS before 156.0.8078.47 permits a remote attacker to achieve code execution inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the macOS user must actively visit or load attacker-controlled content - and the resulting code execution remains contained within the sandbox (Scope:Unchanged), meaning a separate sandbox escape is required for full host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed build (156.0.8078.47); Chromium rated the issue High severity and the CVSS 3.1 base score is 8.8.
Use-after-free in Google Chrome's Transactions Platform lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 156.0.8078.47. Exploitation is unauthenticated per the CVSS vector (PR:N) but requires the user to navigate to attacker-controlled content (UI:R), and because scope is Unchanged the resulting code execution is confined to the sandbox - full host compromise would require chaining a separate sandbox escape. Severity signals conflict and should temper the headline score: NVD-style scoring yields 8.8 while Google rates this Chromium severity Medium, and no CISA KEV listing or public exploit code was identified at time of analysis, so the practical risk is best framed as a high-impact but interaction-gated memory-corruption primitive rather than a confirmed actively exploited threat.
Use-after-free in Google Chrome's SignIn component before version 156.0.8078.47 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. Exploitation requires user interaction (UI:R) and remains bounded by Chrome's sandbox, so host compromise would require a separate sandbox-escape vulnerability; Google rates the Chromium security severity as Low despite a CVSS score of 8.8. No public exploit or CISA KEV listing was identified at time of analysis, and a vendor patch is available.
Use-after-free in Google Chrome's Extensions subsystem enables remote code execution inside the renderer sandbox when a victim opens attacker-controlled crafted HTML, affecting desktop builds prior to 156.0.8078.47. The attack is unauthenticated over the network but requires user interaction (CVSS UI:R), and because the scope is unchanged (S:U), the code execution is contained by the browser sandbox - full host compromise would need a separate sandbox escape. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) on record; risk is moderated by Chrome's auto-update cadence, since users already on 156.0.8078.47 or later are not exploitable.
Use-after-free in Google Chrome's compositing component enables remote code execution inside the browser sandbox when a victim loads a crafted HTML page, affecting Chrome builds prior to 156.0.8078.47. The CVSS vector indicates unauthenticated network access but requires user interaction (UI:R), and the description limits impact to code execution inside the sandbox rather than host escape without a separate sandbox-escape flaw. No public exploit code was identified at time of analysis; Google has released Chrome 156.0.8078.47 as the vendor fix, and risk is tempered by sandbox containment and the need to lure a user to attacker-controlled HTML.
Memory corruption in Google Chrome's Shadow DOM implementation allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting desktop Chrome builds prior to 156.0.8078.47. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact within the compromised renderer, but with unchanged scope and execution confined 'inside the sandbox,' full host compromise would require chaining a separate sandbox-escape flaw. Chromium's own security severity rating is Medium, Google has shipped a fixed build, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in Google Chrome's API before 156.0.8078.47 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to open a crafted HTML page. The flaw is classified as CWE-119 and scored CVSSv3.1 8.8 (AV:N/AC:L/PR:N/UI:R), so user interaction is required but no credentials or special configuration are needed. Google has released Chrome 156.0.8078.47 to address the issue, and no public exploit code or CISA KEV entry was identified at the time of analysis.
Use-after-free in Google Chrome's Script component before 156.0.8078.47 allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and works against default browser configurations, but the code execution is contained by the Chrome sandbox, so host compromise would require chaining a separate sandbox-escape flaw. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis.
Memory corruption in Google Chrome's Skia graphics library prior to 156.0.8078.47 allows remote code execution inside the sandboxed renderer when a user loads a crafted HTML page. The flaw is network-reachable, requires no privileges, and affects default desktop configurations, but exploitation depends on user interaction with malicious web content and code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. No public exploit code was identified at time of analysis, and a vendor patch is available in Chrome 156.0.8078.47.
Use-after-free in Google Chrome's Extensions component (all builds prior to 156.0.8078.47) lets remote unauthenticated attackers run arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring only one click or a drive-by page visit. Rated CVSS 3.1 8.8 (High) with Chromium security severity Medium, the flaw's reach is bounded by sandbox confinement (Scope:Unchanged) - escaping to the host OS or user data requires chaining a separate sandbox-escape bug. No public exploit code or confirmed active exploitation was identified at time of analysis; patched builds 156.0.8078.47 and later are not vulnerable.
Memory corruption in Chrome's Frames component allows a remote attacker who convinces a victim to open a crafted HTML page to achieve arbitrary code execution inside the Chromium renderer sandbox. All Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires no authentication - the only real barrier is the mandatory user interaction of loading attacker-controlled frame content (CVSS UI:R). Google rates the issue High severity (Chromium) and lists it as fixed in the 156.0.8078.47 stable release; no public exploit code has been identified at time of analysis, and the practical impact is bounded by the sandbox, so full host compromise would require chaining with a separate sandbox-escape flaw.
Memory corruption in Google Chrome's Audio component before version 156.0.8078.47 allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is network-reachable, low complexity, and requires no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but exploitation depends on user interaction - the target must navigate to attacker-controlled content that triggers the audio processing path - and resulting code execution is confined to the sandboxed renderer, so host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a vendor patch in Chrome 156.0.8078.47.
Use-after-free in Google Chrome's FileSystem component allows a remote, unauthenticated attacker to potentially achieve arbitrary code execution inside the renderer sandbox by convincing a victim to open a crafted HTML page in any Chrome build prior to 156.0.8078.47. User interaction (loading the malicious page) is the primary exploitation prerequisite, but no credentials or non-default configuration are needed, which is reflected in the CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Impact is contained by the sandbox boundary - absent a separate sandbox-escape chain the attacker does not obtain host-level code execution - and no public exploit code or confirmed active exploitation was identified at time of analysis; Google credits an internal Chrome security team address (chrome-cve-admin@google.com) as the reporter, and a vendor patch exists.
Out-of-bounds read in Google Chrome's Focus handling prior to 156.0.8078.47 can be triggered by a crafted HTML page and may allow arbitrary code execution inside the renderer sandbox. The issue is remotely reachable without credentials but requires user interaction, since the victim must load attacker-controlled web content; CVSS 8.8 reflects high confidentiality and integrity impact with unchanged scope. No public exploit code or CISA KEV entry was identified at time of analysis, and Google has released Chrome 156.0.8078.47 to address it.
Memory corruption in Google Chrome's browser API handling allows remote code execution inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation is unauthenticated from the network but requires user interaction, since the target must navigate to or render attacker-controlled content; successful abuse yields high confidentiality, integrity, and availability impact within the sandboxed renderer rather than at the host level. A vendor patch is available in 156.0.8078.47, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in the Blink DisplayLocking component of Google Chrome allows remote attackers to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R), and because the sandbox is unchanged (S:U), code execution is confined to the renderer - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, but the flaw is rated High by Chromium and the vendor has released a fixed build, making it a high-priority patch item for any environment running Chrome.
A use-after-free in Google Chrome's 'Actor' component allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. The flaw affects Chrome desktop builds prior to 156.0.8078.47 and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - network-reachable, low complexity, and requiring no authentication, but gated by user interaction since the victim must actively visit or load the attacker's page. Impact is explicitly bounded by Chrome's sandbox (Scope:Unchanged), so host-level compromise would require chaining a separate sandbox escape; no public exploit code or confirmed active exploitation was identified at the time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's Compositing component allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in a build prior to 156.0.8078.47. The issue is unauthenticated from the network perspective but requires user interaction (UI:R), and the independent assessment bounds impact to sandbox code execution because scope is Unchanged; host compromise would require chaining a separate sandbox escape. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis.
Use-after-free in Chrome's SiteIsolation component allows a remote attacker who convinces a victim to load a crafted HTML page to corrupt renderer memory and potentially execute arbitrary code at the privilege of the renderer process in any Chrome build prior to 156.0.8078.47. Unauthenticated attackers need only user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but the impact is scope-limited: because the flaw lives in sandboxed renderer code, host-level compromise requires chaining a separate sandbox-escape bug, which is why Google rates the issue only Chromium severity Medium despite the high base score. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis and the bug is not in CISA KEV, so risk is real but conditional on user browsing behavior rather than opportunistic scanning.
Use-after-free in Google Chrome's DevTools component (all versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the browser sandbox by convincing a victim to load a crafted HTML page that drives the vulnerable DevTools code path. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects low attack complexity and no privileges required, tempered only by the mandatory user interaction of visiting the attacker's page and by the fact that execution is confined to the renderer sandbox - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium security severity as Medium despite the high CVSS base score.
Use-after-free in Google Chrome's Media component on Windows (versions prior to 156.0.8078.47) allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so host-level compromise would require a separate sandbox-escape chain; Chromium rates the issue Low despite high CVSS impact metrics. A vendor patch is available, and no public exploit code was identified at time of analysis.
Use-after-free in Google Chrome's Input component before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and no privileges, but code execution is confined to Chrome's sandbox, so a separate sandbox escape is needed for OS-level compromise. No public exploit identified at time of analysis, no confirmed active exploitation, and a vendor patch is available.