A type confusion bug in V8, the JavaScript engine used by Chrome, allows a remote attacker to craft an HTML page that triggers arbitrary code execution within the browser sandbox. The fault enables the attacker to run code that was never intended to execute, effectively breaching the sandbox's isolation guarantees.

Google Chrome users affected are those running V8 versions prior to 151.0.7922.169. The vulnerability is tied to the Chrome browser itself, regardless of operating system, and impacts any user who visits a maliciously constructed web page.

Chromium classifies the flaw as high severity, and while the EPSS score is not available, the lack of KEV listing does not diminish the risk. The attack vector is likely an out‑of‑band crafted HTML page served over the web. If an attacker can lure a user into loading the page, arbitrary code will run inside the sandbox, possibly leading to privilege escalation or data exfiltration on the target machine.