The vulnerability in V8 allows a remote attacker to execute arbitrary code inside the Chrome sandbox by delivering a crafted HTML page. The underlying weakness is an inappropriate type conversion (CWE-843), which permits malicious data to be interpreted in an unexpected format, giving the attacker control over execution flow once the sandbox is bypassed. The consequence is that unprivileged code can compromise the integrity of the browser or gain broader system access if the sandbox is fully escaped.

Google Chrome versions before 150.0.7871.125 are affected. The patch was released in the 150.0.7871.125 stable channel update. Users running any earlier stable, beta or dev channel versions are vulnerable until they upgrade to at least the patched version. It is inferred, based on Chrome's release model, that beta and dev channel versions prior to 150.0.7871.125 also remain vulnerable.

The CVSS score of 8.8 indicates a high severity of this flaw. The EPSS score is below 1%, suggesting that exploitation is currently unlikely in the wild but still possible. The flaw is not listed in the CISA KEV catalog. Attacker would need to host or send a malicious HTML page that a user visits in Chrome; no additional credentials or local interaction are required. Once the sandbox is escaped, the attacker can execute arbitrary code in the context of the browser process. It is inferred from the description that a malicious HTML page must be delivered to the user via a website or local file.