Improper validation of input in Google Chrome's V8 engine allows a remote attacker to craft a malicious HTML page that can cause the browser to execute arbitrary code inside the sandbox. This provision of code execution can compromise the confidentiality and integrity of the user’s data, and the sandbox escape may lead to broader system compromise. The weakness is a classic input validation flaw, marked CWE‑20, and was rated high severity by Chromium’s own assessment.

Google’s Chrome browser on all platforms is affected. Any installation running a version earlier than 156.0.8078.79 is vulnerable. The issue impacts the desktop stable channel and any user who can visit a crafted webpage while browsing.

The vulnerability is exploitable remotely via a browser visit to a crafted page, with no special user privileges required. Because the attack vector is the Internet and the browser renders arbitrary HTML, any user can be targeted through a malicious link or a compromised site. The EPSS score is not available and the vulnerability is not yet listed in CISA’s KEV catalog, but the high Chromium severity and the nature of the flaw suggest a significant likelihood of exploitation in the wild if no patch is applied.