An integer overflow in the V8 JavaScript engine of Google Chrome allows a remote attacker to trigger arbitrary code execution inside a sandboxed process by serving a crafted HTML page. The weakness, identified as CWE-190 and CWE-472, can result in compromised confidentiality and integrity of the victim system when the attacker escapes the browser sandbox.

Google Chrome desktop releases prior to version 149.0.7827.53 on Windows, macOS, and Linux are affected. Users of any of these operating systems with earlier Chrome builds should verify that their browser version is out of scope.

The attack vector requires delivery of a malicious HTML page to the vulnerable browser. The EPSS score of less than 1% indicates a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The high CVSS score of 8.8 reflects the significant impact if an exploit is discovered. Based on the low EPSS score, it can be inferred that active exploitation is unlikely, though high severity warrants vigilance.