The vulnerability is in the JavaScript engine V8 used by Google Chrome and allows a remote attacker to escape the sandbox and execute arbitrary code by loading a specially crafted HTML page. This high‑severity flaw means that a visitor to a malicious site can run code with the privileges of the browser process, potentially compromising the entire system's confidentiality, integrity, and availability.

All users of Google Chrome versions prior to 147.0.7727.55 are affected. The stated fix is to update to Chrome 147.0.7727.55 or later, which implements the corrected V8 sandboxing logic.

The flaw can be triggered by loading a malicious web page, so any user who visits such a page is at risk. EPSS data is not available and the vulnerability is not tracked in the CISA KEV catalog, but the CVSS severity is high and the attack vector is remote via the internet. Exploitation requires no local privileges and can be performed by a web attacker who can host or deliver the crafted content.