The flaw is a type‑confusion weakness in the V8 JavaScript engine that powers Google Chrome. An attacker can deliver a specially crafted HTML page that forces V8 to interpret a value of one type as another, enabling the execution of arbitrary code while the browser remains sandboxed. This allows the attacker to compromise the confidentiality and integrity of the system. The issue is a classic data‑type misuse and is classified as CWE‑843.

All installations of Google Chrome that use a V8 engine older than 157.0.8103.38 are affected. Chrome 157.0.8103.38 and later have the fix included in the stable channel. Users on earlier releases run the risk of exploitation.

Chromium records the vulnerability as medium severity. No CVSS or EPSS score is available, so the precise risk cannot be quantified. The attack vector is remote over the web; a malicious site can trigger the flaw simply by loading the crafted HTML, which requires only that a user visits the page. Although the flaw exists within the browser sandbox, successful exploitation could allow the attacker to execute code with the sandboxed process’s privileges. The vulnerability is not listed in CISA’s known‑exploited vulnerabilities catalog, and no public exploits have been reported as of this analysis. Nonetheless, the remote code execution path is clear and should be remediated promptly.