Type confusion in the V8 JavaScript engine of Google Chrome versions before 155.0.8059.39 allows a remote attacker to craft a malicious HTML page and trigger the flaw. The flaw causes the browser to execute arbitrary code inside the sandbox, effectively breaching the process isolation barrier. The described vulnerability bears a CVSS score of 8.8, signifying a high impact; however, Chromium’s own severity rating for this issue is listed as low, indicating a possible discrepancy between the assessment frameworks.

Google Chrome users on any platform running a version older than 155.0.8059.39 are affected. The vulnerability was present in all branches that shipped the V8 engine prior to the 155.0.8059.39 release.

An attacker can exploit this flaw by hosting a carefully crafted HTML page and luring a user to visit the page. Execution occurs while the code runs within Chrome’s sandbox, but the type confusion bypasses the sandbox’s isolation. The CVSS score of 8.8 indicates a high impact, while no EPSS data is currently published and the vulnerability is not yet listed in CISA’s KEV catalog. Consequently, the risk remains moderate to high depending on user exposure to potentially malicious web content.