Integer overflow in the V8 JavaScript engine present in Google Chrome prior to version 151.0.7922.109 allows a remote attacker to create a malicious HTML page that triggers the flaw and results in arbitrary code execution within the browser’s sandbox, effectively granting the attacker remote code execution privileges inside the sandboxed environment.

Google Chrome browsers with a version lower than 151.0.7922.109 are affected; the fix was delivered in the stable channel update released in August 2026, as referenced by Google’s Chrome releases blog and the Chromium issue tracker.

The CVSS score of 8.8 indicates a high severity vulnerability. No EPSS score is available and the issue is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to supply a crafted HTML page that the victim’s browser processes, making the attack vector essentially remote via web content.