The vulnerability is a type confusion flaw in the V8 JavaScript engine that allows an attacker to execute arbitrary code within the Chrome sandbox. The impact is the potential compromise of the user’s local execution environment, enabling the attacker to run native code. According to the description, the flaw requires a social‑engineering scenario, typically involving a crafted HTML page that an unsuspecting user must open or interact with.

All users running Google Chrome versions prior to 154.0.8037.57 are affected. The flaw exists only in the stable channel of Chrome and is present in versions released before the specified update.

The CVSS score of 8.8 indicates high severity, yet the EPSS score is not available, implying no recent data on real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to lure users to a malicious webpage or trick them into opening a crafted file, so a remote exploitation path depends on social engineering. Even though execution is confined to the sandbox, the threat of privilege escalation or further compromise remains significant.