A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.92 allows an attacker to execute arbitrary code inside the sandbox. The flaw arises when an untrusted or malformed HTML page is processed, enabling the attacker to bypass intended type checks and run code with the same privileges as the sandboxed renderer process. The consequence is a full compromise of the affected browser instance, potentially exposing sensitive data or providing a foothold for further attacks.

Google Chrome users with versions older than 154.0.8037.92 are vulnerable. The vulnerability applies to all platforms supported by Chrome, as it is a core engine issue. Users on any desktop or mobile operating system running an affected Chrome build remain at risk until the patch is applied.

The vulnerability scores a CVSS of 8.8, indicating a high severity. The EPSS score is not available, so the publicly observed exploitation probability cannot be assessed, and it is not yet listed in the CISA KEV catalog. The likely attack vector is a remote attacker delivering a crafted HTML page via a web site or local file, exploiting the browser’s processing of untrusted content. Because the flaw resides within the sandboxed renderer, successful exploitation would allow code to run with renderer‑process privileges, potentially escalating to higher privileges if other vulnerabilities exist on the host.