A type–confusion flaw in the V8 JavaScript engine used by Google Chrome allows a remote attacker to trigger arbitrary code execution inside the browser sandbox. The vulnerability arises from a failure to validate internal type information, which is identified as CWE‑843. If successfully exploited, an attacker could run any code with the privileges afforded to the sandboxed browser process, potentially escalating to full system compromise.

Google Chrome versions prior to 157.0.8103.38 are affected. Any user running those releases on a desktop platform is at risk, regardless of operating system.

The flaw can be exercised from a crafted HTML page served over the network, meaning a denied or cross‑origin request can trigger the bug. No publicly available EPSS score is reported, but the vulnerability is classified as high severity in Chromium’s own assessment and is not listed in CISA’s KEV catalog, indicating that it is not known to be actively exploited in the wild yet. The attack surface remains remote and user‑interaction dependent, yet the potential impact of executing arbitrary code within the sandbox is substantial.