The vulnerability is a type confusion flaw in the V8 JavaScript engine of Google Chrome. It allows a remote attacker to execute arbitrary code inside the sandboxed environment through a specially crafted HTML page. This type of error is classified as CWE-843, which can lead to compromise of confidentiality, integrity, or availability if exploited.

The flaw affects Google Chrome installations that use the V8 engine before version 154.0.8037.57. Any user browsing a maliciously constructed web page can be vulnerable if an older Chrome build is running.

With a CVSS score of 8.8 the vulnerability is deemed high severity. No EPSS data is available, and the issue is not listed in CISA KEV, so the current exploitation probability is uncertain. The likely attack vector is delivered via a crafted HTML page, implying that users who open unknown or malicious web content are at risk. The risk is elevated because the flaw permits code execution even within the browser’s sandbox, potentially leading to privilege escalation or malicious code execution on the host machine.