A type confusion vulnerability exists in the V8 JavaScript engine used by Google Chrome versions earlier than 147.0.7727.55. The flaw, identified as CWE‑843, allows a remote attacker to execute arbitrary code inside the browser’s sandbox through a specially crafted HTML page. Because the code runs with the privileges granted to the sandbox, an attacker can potentially read, modify, or delete data or attempt further privilege escalation if the sandbox is misconfigured.

Google Chrome installations before 147.0.7727.55 on any platform—macOS, Linux, and Windows—are affected. Users who have not upgraded to the patched build remain vulnerable.

The CVSS score of 8.8 reflects a high severity and the EPSS score of less than 1% indicates that widespread exploitation is currently unlikely. The vulnerability is not included in the CISA KEV list. Exploitation requires a user to open or render the malicious HTML page in Chrome, after which the attacker can trigger the type confusion and run code within the sandbox. Prompt patching is essential to reduce risk.