A type confusion issue exists in the V8 JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within a sandbox by enticing a user to visit a specially crafted HTML page. Real-world exploitation has been observed by the Lazarus APT group, which used a fake blockchain-based tank game to deliver the exploit and gain full control over target computers. The attack involves using the type confusion to obtain read and write access to the entire address space of the Chrome process from JavaScript, followed by a second flaw to bypass the V8 sandbox.