A type confusion flaw in the V8 JavaScript engine of Google Chrome can be exploited by a remote attacker who delivers a carefully crafted HTML page. The bug allows execution of arbitrary code while the browser is still confined to the sandbox, providing a privilege escalation path that can compromise the host system. The vulnerability is classified as High severity.

All users of Google Chrome versions prior to 155.0.8059.79 are impacted, regardless of the operating system. Any device capable of rendering web content from an untrusted source and running Chrome could be affected.

The CVSS score of 8.8 indicates a high risk of exploitation, yet the EPSS score of less than 1% reflects a very low likelihood that attackers have targeted this flaw in the wild. The vulnerability is not catalogued in CISA's KEV list. Attackers would need to convince the victim to open a malicious web page; the vulnerability does not require local or privileged access beforehand.