A flaw in the V8 JavaScript engine of Google Chrome allows a remote attacker to run arbitrary code inside the browser sandbox by serving a specially crafted HTML page. The vulnerability enables the attacker to inject malicious input that the engine processes incorrectly, leading to execution of code that would normally be confined to the sandbox. If exploited, the attacker can compromise confidentiality, integrity, or availability of the affected system and potentially pivot to other resources. Based on the description the weakness appears to be a failure to validate or handle input safely during script execution.

Google Chrome browsers running versions prior to 147.0.7727.55 are impacted. Users of any operating system that hosts this browser version are vulnerable.

The vulnerability is graded as high severity by Chromium. No EPSS score is published, and it is not listed in the CISA KEV catalog. Exploitation requires only that an attacker deliver a crafted HTML page to the victim, implying the attack vector is remote and can be triggered normally over the web or via email. Because the flaw is in core engine code, successful exploitation leads to full code execution within the sandbox, potentially allowing out-of-sandbox escape through further bugs. The risk is significant for systems with unpatched Chrome installations.