Google Chrome < 131.0.6778.264 — RCE

An attacker can host or compromise a page that loads JavaScript designed to trigger the type confusion. Any Chrome user visiting that page on a vulnerable build is exposed — no clicks, prompts, or downloads required beyond page navigation. Without a sandbox-escape companion the impact is limited to the renderer process; with one, the attacker achieves code execution under the account running Chrome.

V8 is Chrome's JavaScript and WebAssembly engine; every page Chrome loads exercises it. A type-confusion bug in V8 lets attacker-controlled JavaScript trick V8 into treating one object as a different type, corrupting memory adjacent to that object inside the renderer process. The result is arbitrary code execution constrained to Chrome's renderer sandbox — useful as the first link in a longer exploit chain that pairs it with a separate sandbox escape, but already enough to read browser secrets accessible to the renderer (session cookies, in-memory credentials, content from other tabs in the same site-isolation group).

Probably yes if any of these apply:

Chrome's 131.0.6778.264 emergency early-stable update on January 7, 2025 shipped this fix on its own ahead of the broader 132.x promotion the following week. Microsoft Edge's extended-stable 131.0.2903.147 picked up the same Chromium patch a day later. The bug was reported by an external researcher via Google's VRP and was not seen exploited in the wild before the patch — but the V8 type-confusion class is exactly the primitive that has been chained into multiple in-the-wild Chrome zero-days in prior years, so operators treat these as same-day patches on jump hosts and RDS / Citrix servers where Chrome is interactive.