A memory corruption flaw (CWE-119) exists in the DOM implementation of Google Chrome, enabling a remote attacker to execute arbitrary code inside the browser’s sandbox. The flaw can be triggered by a specially crafted HTML page, allowing the attacker to run code with the same privileges as the user’s browser process. This directly compromises the confidentiality and integrity of the user’s system; if the sandbox is bypassed, the attacker could further escape to the host OS.

The vulnerability affects the Google Chrome browser on all platforms for versions prior to 155.0.8059.84. Users operating with earlier releases should assume the defect is present until a newer version is installed.

The CVSS score of 8.8 underscores high severity. Because the exploit requires an attacker to lure a user to load a malicious page, the threat vector is web-based and depends on user interaction. Although the EPSS score is not available, the lack of inclusion in the CISA KEV catalog does not diminish the potential for exploitation. Operators should treat this as a high-priority risk until the patch is applied.