The vulnerability involves an out-of-bounds read and write in the V8 JavaScript engine used by Google Chrome. A crafted HTML page can cause the browser to read and then write to memory locations outside the intended buffer, allowing an attacker to execute arbitrary code within the browser sandbox. This is a classic bounds‑checking flaw (CWE‑125) combined with an unsafe write (CWE‑787).

All environments running Google Chrome before version 147.0.7727.55 are affected, including Windows, macOS, and Linux distributions. The CPE identifiers list these operating systems, indicating a broad impact across Chrome users on mainstream platforms.

The CVSS score of 8.8 classifies the issue as high severity. EPSS indicates a probability of less than 1% for exploitation, and it is not currently listed in the CISA KEV catalog, suggesting no widespread active exploitation. Nonetheless, the flaw can be triggered remotely by hosting a malicious page that a user visits, so the attack vector is inferred to be remote. Given the severity and potential for arbitrary code execution, prompt remediation is advised.