The CVE description explicitly states that a use‑after‑free in the V8 JavaScript engine in Google Chrome versions before 150.0.7871.46 allows a remote attacker to execute arbitrary code inside the renderer process's sandbox via a crafted HTML page. When a user opens such a page, the stale memory can be reused to run arbitrary code with the privileges of the renderer process. This flaw gives the attacker remote code execution within the sandbox, which is a classic CWE‑416 weakness and can lead to local machine compromise if the sandbox fails.

Any Chrome installation that incorporates the vulnerable V8 build prior to 150.0.7871.46 is affected. Since V8 is a core part of the rendering engine, this‑channel builds on Windows, macOS, and Linux. The advisory does not list specific platform versions; based on this lack of exclusions, it is inferred that all platforms that ship that engine component are at risk.

The CVSS score of 8.8 classifies the vulnerability as high severity. The EPSS score is below 1 %, indicating a very low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. Based on the description, the attack vector is remote: any user who can host or otherwise deliver such content to a user’s browser can trigger the flaw. Although the exploitation probability is low, the risk remains significant because successful exploitation allows remote code execution within the sandboxed renderer.