V8, the JavaScript engine in Google Chrome, contains an out‑of‑bounds read and write that allows an attacker to execute arbitrary code inside the browser sandbox through a specially crafted HTML page. The vulnerability is classified as high severity, meaning a successful exploit would compromise the confidentiality, integrity, and availability of the affected system.

Chrome browsers running a version earlier than 147.0.7727.55 on any operating system are affected. Users who have not installed the latest stable update are at risk.

The attack vector is remote: an adversary can host a malicious web page that triggers the out‑of‑bounds memory operation when a user visits it. No CVSS score is supplied, but the designation “high” indicates significant risk. EPSS data is unavailable, and the vulnerability has not been listed in the CISA KEV catalog. Consequently, the likelihood of exploitation remains uncertain but potentially high given the remote nature of the flaw and the widespread use of Chrome.