Type Confusion in the Skia graphics library in Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox through a crafted HTML page. The flaw arises from incorrect type handling, permitting an attacker to trigger code paths that bypass normal safety checks. In practice, this means that a visitor to a malicious website could run code that may compromise the user’s data or privacy.

All deployments of Google Chrome before version 148.0.7778.216 are affected, regardless of operating system. The vulnerability is present in the desktop builds of Chrome. Users of earlier releases with no plan to upgrade remain exposed.

The Chromium security team has rated the issue as high severity, with a CVSS score of 8.8. The EPSS score is <1%, indicating a low but non‑zero probability that the vulnerability will be exploited in the wild. The flaw is triggered by a crafted HTML page, allowing remote code execution inside the browser sandbox with no user interaction beyond visiting the page. The vulnerability is not listed in CISA’s KEV catalog, so no known exploit is publicly documented. The potential impact is high because execution of arbitrary code in the sandbox could be leveraged to escape the sandbox and access sensitive data or cause other system compromise.