A type‑confusion flaw in the V8 JavaScript engine of Google Chrome can allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The weakness is a classic example of incorrect type handling (CWE‑843) and could, if successful, lead to code running with the privileges granted to the Chrome sandbox, potentially providing a foothold for further compromise of the host system.

All installations of Google Chrome older than version 157.0.8103.38 are affected, as the issue exists in the V8 engine that is part of Chrome’s rendering pipeline. No additional vendors or products are listed as impacted.

The vulnerability is remotely exploitable from a malicious web page (the likely attack vector is a crafted HTML page), and Chromium labels the severity as High. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. Because the flaw permits arbitrary code execution within the sandbox, the risk remains significant until the patch is applied, especially where sandbox escape mechanisms are not guaranteed to remain strict.