A type confusion bug in the V8 JavaScript engine of Google Chrome allowed a remote attacker to craft a malicious HTML page that could cause the browser to execute arbitrary code inside its sandbox. The flaw permits an attacker to bypass type checks and gain control over objects within the sandboxed renderer process, potentially leading to full compromise of the victim’s local environment. The weakness is identified as CWE-843 and results in a classic remote code execution scenario where the attacker can run malicious code with the privileges of the sandboxed process.

Google Chrome before version 154.0.8037.92 is affected. Users and organizations running any Chrome build older than that release are at risk. The issue was reported to the Chromium project and addressed in a stable channel update that shipped version 154.0.8037.92 and later.

The CVSS score of 8.8 categorizes this vulnerability as high severity. No EPSS score is available, and the issue is not listed in CISA's KEV catalog, indicating it is not known to be exploited in the wild yet, but the attack vector is a crafted HTML page, which is readily achievable over the web. An attacker with the ability to serve malicious content to a user can trigger the flaw and execute arbitrary code with the sandboxed renderer’s privileges.