The vulnerability is an integer overflow in the V8 JavaScript engine that lets a crafted HTML page trigger arbitrary code execution inside the Chrome sandbox. This allows an attacker to break isolation boundaries and run code with the privileges of the sandboxed renderer process. The specific weakness corresponds to CWE‑190, integer overflow, which can corrupt internal data structures.

Google Chrome versions prior to 153.0.8010.47 are vulnerable on all operating systems where the V8 engine is used. The issue appears in the stable desktop channel, as documented in the Chrome Release Blog. Users running a pre‑153.0.8010.47 build must upgrade to a patched version to eliminate the flaw.

The CVSS score of 9.6 indicates critical severity, yet the EPSS score is below 1 %, suggesting a low probability of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog, implying no known mass exploitation campaigns. An attacker would need to lure a user to load a malicious HTML page—likely via phishing or a compromised website—then exploit the integer overflow to escape the sandbox. While exploitation requires user interaction to view the page, successful exploitation would provide remote code execution with the privileges of the sandboxed renderer, which may be escalated further under certain conditions.