A type‑confusion bug in the V8 JavaScript engine of Google Chrome allows an attacker who can serve a carefully crafted HTML page to potentially execute arbitrary code inside the sandbox. The flaw arises from interpreting data as the wrong type during engine execution, which can bypass type safety guarantees. The vulnerability is classified as Chromium security severity High and falls under CWE‑843 (Type Confusion).

Affected products are Google Chrome on all platforms, versions prior to 157.0.8103.38. Users on stable, beta, dev, or canary channels running these earlier builds are at risk. The update 157.0.8103.38 introduces a patch that eliminates the type‑confusion path.

No EPSS score is currently published, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires that an attacker can deliver a malicious HTML page to a user’s browser, which is a remote web‑based vector. Because the flaw exploits a type‑confusion bug inside the sandbox, successful exploitation would result in remote code execution with the privileges of the sandboxed renderer process. With the absence of an official KEV listing, the likelihood hinges on the prevalence of the affected versions and the typical web‑content exposure. Patch removal of the bug removes the risk, as no other public exploit paths are reported.