Type confusion in the V8 JavaScript engine allows a remote attacker to execute arbitrary code inside the browser sandbox when a crafted HTML page is loaded. The flaw rests on improperly distinguished types, as identified by CWE-843. The consequence is that any code running in the client’s browser can be hijacked, potentially leaking confidential data or performing malicious operations on the user’s system. The impact is confined to the victim’s machine, but the attacker could exploit it without needing local access, relying only on a malicious web page.

Google Chrome browsers earlier than version 154.0.8037.92 are susceptible. Users who have not upgraded beyond this version remain vulnerable.

The CVSS score of 8.8 classifies this vulnerability as high severity. With no EPSS score available and it not being listed in the CISA KEV catalog, the known exploitation probability is uncertain, but remote exploitation via a malicious web page is highly feasible. The likely attack vector is a remote attacker delivering a crafted HTML page that triggers the type confusion during script execution, allowing code to run inside the sandbox. Once executed, the attacker could circumvent sandbox constraints to access sensitive data or system resources.