A type confusion flaw in the V8 JavaScript engine of Google Chrome allows a remote attacker to execute arbitrary code inside the browser’s sandbox. The vulnerability arises when the engine misinterprets the type of an object during the evaluation of a crafted HTML page, enabling code execution within the confined sandbox environment.

The flaw affects versions of Google Chrome prior to 151.0.7922.72. Any installation of Chrome running an unsupported version in an enterprise or individual environment is at risk. The affected functionality is part of the V8 engine, which processes all JavaScript code loaded by the browser.

The CVSS score of 8.8 indicates a High severity vulnerability. The EPSS score of less than 1% suggests a low yet nonzero probability of exploitation. Based on the description, a remote attacker can deliver a specially crafted HTML page that, when opened by a victim, triggers code execution inside the browser sandbox. Access to the page is required, which is often achieved through browsing or email. The vulnerability is not listed in the CISA KEV catalog. The risk to organizations that have not yet updated Chrome remains elevated.