This vulnerability results from a type confusion bug in the WebRTC component of Google Chrome versions prior to 148.0.7778.96. A crafted HTML page can cause the browser to interpret data as an unintended type, enabling arbitrary code execution within the browser sandbox. The flaw is classified as CWE‑843 and allows a remote attacker to run malicious code inside the sandboxed process, potentially providing a foothold for further exploitation beyond the sandbox boundaries. Although officially rated Medium severity, the ability to bypass sandbox protections makes the impact significant.

All installations of Google Chrome below version 148.0.7778.96 are affected. No other vendors or products are listed as impacted.

The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no widely‑known, active exploitation has been reported yet. However, the flaw is remotely exploitable by presenting a malicious HTML page to a user’s browser. Based on the description, the likely attack vector is a crafted HTML page loaded in the browser, where the type confusion occurs. While the absence of a public exploit reduces immediate risk, the potential to escape the sandbox and execute code warrants a high diligence level for organizations that rely on Chrome for web browsing or web‑enabled applications. The CVSS score of 8.8 indicates a high severity rating.