The vulnerability is a type confusion in the V8 JavaScript engine that existed in Google Chrome versions before 151.0.7922.169. When a specially crafted HTML page is rendered, the type mismatch allows an attacker to execute arbitrary code inside the sandboxed renderer process. Because the code runs with renderer‑process privileges, it can potentially break out of the sandbox and compromise the host system. This flaw is classified as high severity and is associated with CWE‑843.

Desktop users running Google Chrome prior to version 151.0.7922.169 are susceptible. The flaw does not affect Chrome on mobile or other platforms; only the desktop stable channel is listed.

An attacker can trigger the flaw by hosting a malicious web page that the victim opens or visits. No special privileges or network access are required beyond normal browsing. The CVSS score of 8.8 indicates high severity, the EPSS score of less than 1% shows a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but the remote nature still poses a significant risk to users who do not install the latest update.