A memory corruption flaw was discovered in the V8 JavaScript engine used by Google Chrome, allowing a remote attacker to potentially execute arbitrary code within the browser sandbox by serving a specially crafted HTML page. The bug enables the attacker to gain arbitrary code execution in the context of the sandboxed process, compromising data, credentials, or other privileged information that the user may access through the browser. The weakness corresponds to CWE-119, which involves bounds or bounds-related errors that can lead to unauthorized memory access.

Google Chrome browsers running any version before 156.0.8078.73 are affected.

The Chromium security team rated the issue as high severity. No EPSS score is available, and the vulnerability is not included in CISA’s KEV catalog, implying that the exploitation probability has not been formally quantified. Given that a crafted HTML page can be delivered remotely, the risk is primarily to users who visit malicious web content, and the attack requires no special user interaction beyond normal browsing. Exploitation would occur through the normal rendering path of the web engine, making the attack vector remote and broadly exploitable.