The vulnerability originates from an inappropriate implementation in the V8 JavaScript engine of Google Chrome versions older than 147.0.7727.55. A malformed or specially crafted HTML page can trigger undefined behavior in the engine, allowing a remote attacker to run arbitrary code within the browser's sandbox. This flaw permits code execution with the privileges of the sandboxed process, potentially enabling attackers to compromise the user’s system or exfiltrate sensitive data.

Google Chrome browsers earlier than version 147.0.7727.55 on any supported platform (Windows, macOS, Linux, or other operating systems where Chrome runs) are impacted. The vulnerability affects the Chrome product bundle across all major operating systems.

The CVSS base score of 8.8 classifies this issue as high severity. The EPSS indicates a very low probability of exploitation (< 1%). The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the weakness remotely by delivering a malicious HTML page via the internet or a local network, with no need for additional user interaction beyond visiting the page. The flaw is a classic example of a memory corruption bug in a JavaScript engine, and exploit developers may leverage it to bypass the browser sandbox.