V8, the JavaScript engine embedded in Google Chrome, suffered a type‑confusion flaw that permitted a maliciously crafted HTML page to trigger a memory corruption error. The vulnerability can lead to out‑of‑bounds memory access, which in turn could allow an attacker to influence program execution or leak sensitive data. The weakness is a classic type‑confusion issue (CWE‑843) and the official severity assigned by Chromium is medium.

The flaw is present in all versions of Google Chrome before 147.0.7727.101. This includes the stable channel builds shipped to end users, enterprise deployments, and any systems that have not upgraded to the patched release. Any device running an affected Chrome version that processes untrusted Web content is potentially exposed.

The CVSS score is 8.8, indicating high severity, reflecting the need for a crafted input delivered over the network but with no known active exploitation. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting that publicly disclosed exploitation is not yet widespread. Nevertheless, the attack vector is remote and can be carried out through a single malicious HTML page. The risk is therefore high, with the primary mitigation being the application of the patch that appears in the quoted release notes.