The vulnerability resides in the V8 JavaScript engine of Google Chrome and allows a remote attacker to execute arbitrary code within the sandbox by serving a specially crafted HTML page. The flaw arises from an inappropriate implementation that fails to properly isolate execution context. This vulnerability involves a memory corruption flaw (CWE-119 and CWE-125). Successful exploitation would let the attacker run code with the privileges of the Chrome renderer process, potentially bypassing the browser’s sandbox protections and compromising the host system.

All users of Google Chrome on desktop platforms running a version prior to 149.0.7827.53 are affected. Versions of the stable channel that have not yet been updated to 149.0.7827.53 or later are vulnerable, regardless of operating system.

The vulnerability is rated as high severity by Chromium security. Because the attack requires only a crafted web page, the attack vector is remote and can be triggered by any site the user visits or any email containing a malicious link. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the lack of a public exploit does not mitigate the inherent risk of remote code execution. Therefore, the likelihood of exploitation remains significant for attackers targeting Chromium users who have not applied the latest update.