The vulnerability is an integer overflow in the V8 JavaScript engine in Google Chrome prior to 149.0.7827.53. It can be triggered by a specially crafted HTML page, allowing a remote attacker to execute arbitrary code within the browser’s sandbox process. The overflow arises from a numerical error when handling certain data structures in V8, identified as CWE-472, and also involves an integer overflow classified as CWE-190.

All installations of Google Chrome running a version earlier than 149.0.7827.53 on any supported desktop platform are affected. The issue is corrected in Chrome 149.0.7827.53 and later releases.

The advisory rates the vulnerability as High severity, with a CVSS score of 8.8. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a malicious webpage that a user opens in Chrome; this inference is drawn from the description stating that a crafted HTML page can trigger the overflow. Exploitation requires remote delivery of the page; no additional network or local conditions are explicitly mentioned, and the vulnerability is mitigated by applying the patch.