V8, the JavaScript engine in Google Chrome, contains a buffer overflow that allows a remote attacker to trigger arbitrary code execution inside the browser sandbox by delivering a specially crafted HTML page. This flaw, identified as a stack correlation oversight (CWE‑121) and a heap buffer overflow (CWE‑787), can compromise confidentiality, integrity, and availability of the affected system if the user opens the malicious content.

Google Chrome versions prior to 154.0.8037.92 on desktop platforms are susceptible. The issue applies broadly across Windows, macOS, and Linux distributions that ship the affected builds.

With a CVSS score of 8.8 the vulnerability is considered high severity, and the EPSS score is below 1%, indicating a very low exploitation probability. The flaw is not listed in the CISA KEV catalog. Because the attack vector requires the victim to load a malicious HTML page in Chrome, the threat environment is remote, but execution can be accelerated by social engineering or compromised websites.