An out-of-bounds memory access flaw in the V8 JavaScript engine of Google Chrome allows a remote attacker to craft a malicious HTML page that, when rendered, can trigger arbitrary code execution inside the browser sandbox. The vulnerability can be exploited from a remote source and leads to the execution of arbitrary code with the privileges of the browser process, potentially compromising the system through privilege escalation, data exfiltration, or further lateral movement.

All versions of Google Chrome that have not yet received a V8 update are affected. Specific version details are not provided in the CVE data. The flaw is limited to desktop installations that use the V8 JavaScript engine.

The CVSS score is 8.8, indicating a high severity vulnerability. No EPSS score is available, and it is not listed in the CISA KEV catalog. The exploit is remote and requires delivery of a crafted HTML page to the victim’s browser; the attacker need not have local access beyond being able to host or embed the malicious content. While the browser’s sandbox can mitigate some damage, the flaw already allows escape into the sandboxed process, so the risk remains significant. Given the absence of a publicly known proof‑of‑concept, the likelihood of exploitation is uncertain but the potential impact is severe.