The vulnerability stems from an uninitialized variable in the V8 JavaScript engine of Google Chrome prior to version 156.0.8078.47. This flaw allows an attacker to inject arbitrary code into the browser’s sandboxed environment by delivering a specially crafted HTML page. The impact is that the attacker gains the privileges of the sandboxed process, which can lead to corruption of browser data, privilege escalation within Chrome, or execution of additional malicious code, resulting in loss of confidentiality, integrity, and availability of the affected system.

All desktop installations of Google Chrome that run the stable channel before the 156.0.8078.47 update are affected. This includes machines on any operating system that have not yet updated to the mentioned version.

The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious web page that a victim visits; that inference is drawn from the fact that the flaw is triggered by a crafted HTML document. If an attacker successfully hosts or distributes such a page, the uninitialized variable in V8 can be used to execute arbitrary code inside the sandboxed process. The CVSS score of 8.8 signals high severity with significant potential impact on all affected systems, making timely patching advisable.