A type confusion flaw in DevTools enables a remote attacker to run code within the sandbox by navigating to a specially crafted web page. The attacker can exploit the vulnerability through social engineering, such as luring a user into opening a malicious link or file. Once exploited, arbitrary code can be executed with the privileges of the sandboxed process, potentially compromising the host system if the attacker can escape the sandbox.

Google Chrome is affected by this issue. Versions prior to 157.0.8103.38 contain the vulnerability. No other vendors or products are listed.

The CVE lists a high Chromium security severity but does not provide an EPSS score or CVSS metric, so the exact likelihood of exploitation is unknown. The vulnerability is not in CISA’s KEV catalog. Remote code execution requires the user to visit a malicious page, so the attack vector is phishing or deceptive traffic. Because the flaw resides in the browser’s developer tools, it can be triggered by observing an innocuous page that contains an embedded script designed to take advantage of the type confusion bug.