A type confusion flaw in the Turbofan JIT compiler of Google Chrome, present before version 147.0.7727.101, lets an attacker run arbitrary code within the browser’s sandbox. The bug, classified as CWE‑843, was surfaced with the Chromium high‑severity flag. The flaw allows code execution without needing prior compromise of the operating system, leveraging only an attacker‑controlled HTML page.

Any installation of Google Chrome older than 147.0.7727.101 is susceptible. The affected product is the Chrome browser for desktop operating systems. Users whose browsers have not yet been updated to 147.0.7727.101 or newer are at risk.

The vulnerability is remotely exploitable by serving a crafted HTML page, so the attack surface extends to any user who visits a malicious site. The EPSS score is not provided and the flaw is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation yet. Nevertheless, the application of a High rating by Chromium and the fact that the flaw allows arbitrary code execution inside the sandbox warrant a high‑assurance response. Attackers would need no additional foothold beyond the browser, making effective exploitation likely if a user opens a malicious page. Its CVSS score is 8.8, indicating a high severity level.