Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) The vulnerability, rated high in Chromium’s internal severity, represents a type confusion flaw (CWE-843). This can allow the attacker to read memory inside the sandbox and potentially bypass normal sandbox restrictions.

Google Chrome versions prior to 156.0.8078.47 are affected. The issue is tied specifically to the V8 engine embedded in Chrome’s renderer process. Users running any Chrome installation that has not yet updated to 156.0.8078.47 or newer are at risk.

The flaw is remotely exploitable through a web page that a victim visits; therefore the attack vector is inferred to be via HTTP(S) traffic. No exploit code is publicly known and, according to EPSS, exploitation likelihood is low (<1%). The CVSS score of 6.5 indicates moderate severity, but this does not diminish the potential impact since the vulnerability permits code execution within the sandbox. The vulnerability is not listed in the CISA KEV catalog, yet its high internal Chromium severity and the fact that it is exploitable via crafted web content warrants immediate concern for organizations relying on Chrome for web browsing.