A memory corruption flaw in the V8 JavaScript engine of Google Chrome before version 155.0.8059.84 permits a remote attacker to execute arbitrary code inside the browser sandbox by presenting a crafted HTML page. The vulnerability, identified as CWE‑119, leads to code execution within the sandbox process, raising the potential for more privileged operations through additional exploitation steps.

All desktop installations of Google Chrome in the stable channel that are older than version 155.0.8059.84 are affected. The issue applies to the V8 engine used in those releases and does not affect later patched versions.

The CVSS score of 8.8 classifies the flaw as high severity, and the EPSS score is 0.00223 (approximately 0.22%), indicating a low likelihood of exploitation. The absence of the vulnerability from the CISA KEV catalog suggests it has not yet been widely exploited. The most likely attack vector is remote via a malicious HTML page loaded in the victim’s browser, which, if successful, would grant the attacker code execution within the sandboxed environment and could serve as a foothold for further compromise.