A use-after-free flaw in WTF, Chromium's internal base library, affects Google Chrome desktop builds before 156.0.8078.73. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack needs no login, but the user must open the page, and the CVSS base score is 8.8 (High). Code execution is limited to the sandbox, so full system compromise would normally need a second sandbox-escape flaw.
Google · Chrome
Google Chrome before 156.0.8078.73 contains an improper input validation flaw in the Command component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The attack requires that a user loads the crafted page. Chromium rates the issue High, while the NVD record gives a CVSS score of 9.6 (Critical).
Google · Chrome
Google Chrome versions before 156.0.8078.73 contain an input validation flaw in Skia, Chrome's graphics library. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must open the malicious page, for example through a link or email, and no privileges are required. The description does not claim a sandbox escape.
Google · Chrome
Google Chrome versions prior to 156.0.8078.73 contain a use-after-free flaw in the Paint component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack needs no authentication but requires user interaction, such as visiting the page. The description does not mention a sandbox escape, so full system compromise would normally require an additional vulnerability.
Google · Chrome
Google Chrome desktop versions before 156.0.8078.73 contain a memory corruption flaw in the Cache component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The CVSS score assumes high impact, but the vendor description limits the flaw to the sandbox, and no sandbox escape is described.
Google · Chrome
Chrome versions before 156.0.8078.73 contain a memory corruption flaw in Skia, the 2D graphics library used by Chrome. A remote attacker can lure a user to a crafted HTML page and execute arbitrary code inside the browser sandbox. The attack requires the user to visit the malicious page; the sandbox itself is not reported as escaped.
Google · Chrome
A use-after-free flaw in the Turbolev component of Google Chrome before 156.0.8078.73 allows code execution inside the Chrome sandbox. A remote attacker can exploit it by luring a user to a crafted HTML page, so user interaction is required. Code execution is limited to the sandbox on its own; a full system compromise usually requires a second flaw. The NVD status and CVSS 8.8 score should be verified because sources disagree on them.
Google · Chrome
A memory corruption flaw in the Payments component of Google Chrome before 156.0.8078.73 can be triggered by a crafted HTML page. A remote attacker who gets a user to open such a page can execute arbitrary code inside the browser sandbox. The attack needs no authentication, but the user has to load the page, for example via a link, a compromised site or an advertisement. The vendor rates the Chromium security severity as High and the CVSS base score is 8.8.
Google · Chrome
Improper input validation in the Skia graphics library of Google Chrome before 156.0.8078.73 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs to lure a user to a crafted HTML page; no authentication is required. Chromium rates the issue Critical, and NVD assigns CVSS 8.8.
Google · Chrome
A use-after-free vulnerability in the FileSystem component of Google Chrome before 156.0.8078.73 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page; no authentication is required, but user interaction is. Chromium rates the issue High (CVSS 8.8). The sandbox limits the impact, and full device compromise would require an additional sandbox escape, which is not described in the available sources.
Google · Chrome
Google Chrome versions before 156.0.8078.73 contain a use-after-free flaw in the Compositing component, which manages visual layers on screen. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user visits the attacker's page, and the sources reviewed describe no sandbox escape.
Google · Chrome
A use-after-free memory-safety flaw in PDFium, the PDF rendering engine of Google Chrome prior to 156.0.8078.73, can be triggered by a crafted HTML page. A remote attacker may potentially execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, but no authentication.
Google · Chrome
Google Chrome versions before 156.0.8078.73 contain a use-after-free flaw in the Layout component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The victim must open the malicious page, for example through an email link or a compromised website. The vendor description does not report a sandbox escape.
Google · Chrome
Improper input validation in the ReadingList component of Google Chrome allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. Exploitation requires that a user visits a crafted HTML page, for example a malicious or compromised website or link. Chromium rates the flaw High (CVSS 8.8); code execution is limited to the sandbox and does not by itself give full control over the system.
Google · Chrome
Google Chrome desktop versions before 156.0.8078.73 contain an out-of-bounds write in the Editing component. A remote attacker can potentially execute arbitrary code outside the Chrome sandbox by luring a user to a crafted HTML page. Exploitation requires that the user visits the page, but no authentication. NVD lists a CVSS score of 9.6 (Critical), while Red Hat rates it 8.8 (High).
Google · Chrome
Google Chrome before 156.0.8078.73 contains a use-after-free flaw in the Modularization component (CVSS 8.8, CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No user privileges are required, but the victim must open the page, so every Chrome installation with web access is exposed.
Google · Chrome
A memory corruption flaw in Skia, the graphics rendering library of Google Chrome, may allow a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires that a user loads a crafted HTML page, so user interaction is needed, but no authentication is required. Google fixed the flaw in the Stable channel update of 27 October 2026. No exploitation has been reported so far.
Google · Chrome
A use-after-free flaw in the Animation component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires a victim to open a crafted HTML page, for example on a malicious or compromised website. The flaw is rated High by Chromium, and CISA SSVC lists exploitation as none and automatable as no.
Google · Chrome
A use-after-free vulnerability (CWE-416) in the Animation component of Google Chrome desktop allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs a user to visit a crafted HTML page. NVD rates it CVSS 8.8 (High), while Chromium rates it Medium; the sandbox limits the impact, and no sandbox escape has been reported for this CVE.
Google · Chrome
Google Chrome versions before 156.0.8078.73 contain an improper access control flaw in the Forms component that allows a remote attacker to bypass the web origin policy. The attacker must lure a user to a crafted HTML page, so user interaction is required. Successful exploitation can expose data and sessions on other websites the user is logged into. Chromium rates the flaw High, and the CVE record reports partial confidentiality and integrity impact with no availability impact.
Google · Chrome
Google Chrome Headless mode contains an improper input validation flaw (CWE-20). A remote attacker who gets a user to open a crafted HTML page may be able to execute arbitrary code inside the browser sandbox. Exploitation requires user interaction, and the impact is rated High by Chromium.
Google · Chrome
Improper input validation in the Metrics component of Google Chrome on macOS before 156.0.8078.73 can be abused by a remote attacker. A crafted HTML page can potentially execute arbitrary code inside the browser sandbox. The attack requires that a user opens the malicious page, for example via a link in an email or on a website.
Google · Chrome
Google Chrome before 156.0.8078.73 contains a use-after-free flaw (CWE-416) in the ImageCapture API. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The victim must visit the malicious page, and no authentication is needed. Full system compromise would normally also require a sandbox escape, which is not part of this CVE.
Google · Chrome
Google Chrome versions before 156.0.8078.73 contain a missing authorization flaw in the Video component. A remote attacker can bypass the web origin policy by luring a user to a crafted HTML page. Exploitation requires that the victim visits the page and interacts with it, so it is a drive-by risk for any browsing user.
Google · Chrome
Improper input validation in the Compositing component of Google Chrome prior to 156.0.8078.73 can be abused by a remote attacker via a crafted HTML page. Successful exploitation could allow arbitrary code execution outside the Chrome sandbox. The attacker needs the user to open the malicious page, for example through a compromised website or a phishing link. Chromium rates the issue as High, and the CVSS base score is 9.6 (Critical).
Google · Chrome
