V8, the JavaScript engine used by Google Chrome, has a type confusion flaw in versions prior to 148.0.7778.216. This flaw permits an attacker who can persuade a user to install a malicious Chrome extension to execute arbitrary code, but only inside the extension’s sandboxed environment. The vulnerability is a classic example of CWE‑843, where a program assumes an object is of one type and processes it as such, leading to unintended behaviour.

The flaw affects Google Chrome browsers running versions older than 148.0.7778.216. Any user of these versions who installs extensions from untrusted or unknown sources is at risk.

Although the flaw requires user interaction to install a malicious extension, the potential impact is high for an enabled extension can run code with the extension’s privileges. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting that exploitation may occur sporadically but is not yet widely observed. In the absence of a publicly released exploit, the risk remains moderate but requires proactive mitigations. The CVSS score of 8.8 indicates a high severity vulnerability.