The vulnerability is an out-of-bounds read and write flaw in the V8 JavaScript engine that powers Google Chrome. The flaw allows an attacker controlling a crafted HTML page to trigger an out-of-bounds memory access inside the browser's sandbox, which can be escalated to arbitrary code execution. The associated weakness aligns with buffer overrun and arbitrary memory access categories.

Google Chrome browsers prior to version 149.0.7827.103 on any platform that runs the V8 engine are affected. The flaw was present in the stable channel as of the June 2026 release.

The CVSS score is 8.8, indicating a high severity rating. The EPSS score is < 1%, and the vulnerability is listed in the CISA KEV catalog, reflecting known exploitation or significant risk. The likely attack vector is remote – a malicious web page served over the network can contain the crafted payload that triggers the out-of-bounds read/write, escaping the browser sandbox and allowing execution of arbitrary code on the local machine.