The vulnerability is a type confusion flaw in V8, the JavaScript engine used by Google Chrome. A malicious HTML page can trigger the bug, allowing an attacker to execute arbitrary code inside Chrome's sandbox. This flaw corresponds to CWE-843. The attacker can run code with the privileges of the sandboxed renderer process, potentially leading to compromise of the host system if the sandbox is bypassed.

Google Chrome versions prior to 152.0.7977.82 are affected. The issue was addressed in the stable channel update released on September 2026. Systems running earlier versions should update to 152.0.7977.82 or a later patch.

The EPSS score is 49%, indicating a high exploitation probability, and the vulnerability is listed in the CISA KEV catalog. The CVSS score of 8.8 indicates high severity. The attack vector is remote via a crafted HTML page that a user would need to open; consequently, successful exploitation requires the victim to view a malicious page. The description states that code execution occurs inside the sandboxed renderer process. The likely impact is thus confined to that sandbox until a sandbox escape can be performed, which is an inference. Based on the potential for such a sandbox escape, it is prudent to patch promptly.