A type confusion flaw in V8 exposed in Google Chrome allows a maliciously crafted HTML page to overwrite data types and ultimately run code inside the sandbox. This vulnerability is consistent with CWE-843 and gives a remote attacker the ability to execute arbitrary instructions with the privileges granted to the sandboxed process, compromising confidentiality, integrity, and availability of the affected system. The flaw was judged a high severity issue by Chromium's security team.

Google Chrome browsers older than version 148.0.7778.168 are affected. The vulnerability is specific to the V8 JavaScript engine used in the stable desktop channel, as noted in Chrome's release notes for the affected version.

The CVSS score for this issue is 8.8, indicating high severity; the EPSS score is not available, and it is not listed in the CISA KEV catalog. The attack vector requires the user to load a HTML page in the browser; therefore, the risk is limited to situations where the user can be induced to view malicious content. However, because the flaw enables arbitrary code execution, the potential impact remains high if exploitation succeeds.