A type confusion flaw exists in the HTML bindings used by Google Chrome. The bug allows a maliciously crafted HTML page to cause the browser to reinterpret data of an incorrect type, enabling a remote attacker to execute arbitrary code that runs inside the sandbox environment. The weakness is identified as CWE-843, an inappropriate type conversion. In effect, the attacker gains execution privileges within the browser context, which could lead to credential theft, data exfiltration, or launching further attacks on the system.

The vulnerability affects all installations of Google Chrome older than version 154.0.8037.57, regardless of operating system, as the flaw resides in the core rendering engine shared across all desktop platforms.

The CVSS score of 8.8 indicates high severity. Because the exploit can be performed remotely by delivering a crafted HTML page, the attack surface is broad; no user interaction beyond viewing the page is required. The EPSS score is currently unavailable, yet the fact that it is a remote code execution vector suggests a high likelihood of exploitation. Google has not listed this issue in the CISA KEV catalog, which does not preclude real-world attacks but means the vulnerability may not yet have widespread known exploitation. The primary vector is via a malicious website or an email attachment that opens in Chrome.