A 32‑bit integer overflow in the V8 JavaScript engine of Google Chrome, found in versions before 149.0.7827.53, permits a remote attacker to execute arbitrary code inside Chrome's sandbox when a specially crafted HTML page is loaded. The flaw is classified as high severity by Chromium, and the potential impact is that the attacker can run code with the restricted privileges of the browser, bypassing normal security boundaries.

All installations of Google Chrome with a revision older than 149.0.7827.53 are affected. The vulnerability exists in the core V8 engine, meaning that every platform (Windows, macOS, Linux, Android, iOS) running the unauthenticated pre‑149.0.7827.53 build is vulnerable.

The exploit requires a malicious web page that the user opens, making the attack vector likely a remote web‑based delivery. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, but the CVSS‑derived high severity of 8.8 suggests a substantial risk if left unpatched. An attacker who can convince a user to visit a crafted page can achieve arbitrary code execution within the browser sandbox, which can be leveraged for further escalation or persistence.