The flaw is a memory corruption vulnerability in the V8 JavaScript engine that ships with Google Chrome versions older than 156.0.8078.73. A specially crafted HTML page can trigger the defect, potentially allowing a remote attacker to execute arbitrary code inside the browser’s sandbox. The issue is classified as high severity by Chromium, and because the sandbox can be bypassed to run native code, the impact includes full system compromise if the user loads malicious content.

All installations of Google Chrome running any version prior to 156.0.8078.73 are affected. This includes the standard stable channel releases and any custom builds that contain the old V8 engine.

Exploitation requires the victim to visit a malicious web page containing the crafted HTML. Although no EPSS score is currently available, the high severity rating and the lack of a CISA KEV listing suggest that the vulnerability is considered dangerous but not yet proven in the wild. Because the code runs inside the sandbox, this flaw offers a path to escape the sandbox and execute native code, making it a significant threat for users who browse untrusted sites.