The vulnerability is a type confusion issue in the V8 JavaScript engine used by Google Chrome. A crafted HTML page can trigger a mismatch between expected and actual data types, allowing an attacker to execute arbitrary code within the browser sandbox. This can lead to full compromise of the user’s system by bypassing the sandbox’s isolation. The weakness matches CWE‑843, which describes an error in handling two different data types as if they were the same, leading to memory corruption or execution control changes.

All installations of Google Chrome that use a V8 version prior to 154.0.8037.92 are affected. This includes the stable desktop channel on Windows, macOS, Linux, and Chrome OS. The vulnerability exists across all architectures that run this Chrome version, regardless of language or configuration. Upgrading the browser to 154.0.8037.92 or higher removes the flaw.

The CVSS score of 8.8 indicates a high severity. The lack of an EPSS score makes quantifying current exploitation risk difficult, but the vulnerability allows remote code execution without local privileges, suggesting a high risk in environments that regularly load untrusted web content. The CVE is not listed in CISA KEV, indicating no known mass exploitation yet. Attackers would need to lure a user to a malicious web page; once the page loads, the type confusion could be triggered to escape the V8 sandbox and execute code under the privileges of the current Chrome process.