This vulnerability involves a type confusion bug in the V8 engine of Google Chrome before version 149.0.7827.53. Type confusion occurs when the program incorrectly interprets the type of a variable, leading to unexpected behavior. In this case, it enables remote attackers to execute arbitrary code inside the sandbox environment by delivering a specially crafted HTML page. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability with no privileges required and user interaction needed. The vulnerability is tracked as CWE-843. The vendor advisory URL is provided but does not explicitly state patch status in the input data.

Successful exploitation allows remote code execution inside the Chrome sandbox, potentially compromising the browser's security boundaries. This can lead to full compromise of the browser process, affecting confidentiality, integrity, and availability of the user's browsing environment. No known exploits in the wild have been reported at the time of this analysis.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 149.0.7827.53 or later once the update is available. Until then, exercise caution when browsing untrusted websites and avoid opening suspicious HTML content.