EUVD-2026-89377
GHSA-xv44-w734-34ch
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious HTML page
-
DeliveryServe crafted JavaScript to V8
-
ExploitTrigger type confusion in engine
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactChain sandbox escape for full compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load an attacker-crafted HTML page in an unpatched Google Chrome build prior to 154.0.8037.92 (UI:R). No authentication or privileges are needed (PR:N). The primary limiting factor is that code execution is confined to the renderer sandbox (S:U) - achieving full host compromise requires an additional sandbox-escape vulnerability. Exploitation works against default Chrome configurations with JavaScript enabled (the default), so no non-default settings are required beyond convincing the user to visit the page. |
| Impact | This is a genuinely high-priority browser vulnerability rather than an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes an unauthenticated, low-complexity, network-reachable type confusion in V8, Chrome's JavaScript engine - the exact class Chrome attackers weaponize most often. The only meaningful gate is UI:R (the victim must visit a page), which is trivially satisfied by drive-by/malvertising. Scope is Unchanged (S:U), meaning code executes inside the renderer sandbox, so a full compromise requires chaining a separate sandbox-escape - this is why Google labels the memory-corruption severity 'High' rather than 'Critical.' No EPSS score, CISA KEV entry, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; however, V8 type-confusion bugs historically move quickly from patch to n-day exploitation, and Google's opaque tracker (issues.chromium.org 556908674) is standard practice to delay POC development. Treat the absence of KEV/EPSS as unmeasured, not as evidence of low risk. |
| Exploit ScenarioDerived | An attacker hosts or injects (via a compromised ad network or watering-hole site) a crafted HTML page containing malicious JavaScript that triggers the V8 type confusion. When a victim running an unpatched Chrome (<154.0.8037.92) simply loads the page, the attacker gains arbitrary code execution within the renderer sandbox. No public POC was provided at time of analysis, but a working exploit would typically be paired with a sandbox-escape to achieve full system compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Type confusion in the V8 JavaScript engine allows remote code execution inside the Chrome renderer sandbox on any unpatched build prior to 154.0.8037.92. Because the flaw is triggered by a crafted HTML page, the attacker needs only to convince a victim to visit it - no credentials or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8, Chromium severity High) - and exploitation works against default configurations with JavaScript enabled. Successful exploitation yields arbitrary code execution confined to the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape bug; exploitability is high but not trivially mass-exploitable. No public exploit was identified at time of analysis, and our assessment rates this as a genuinely high-priority browser vulnerability rather than an inflated-CVSS artifact. Vendor-released patch: 154.0.8037.92.
RemediationAI
Upgrade to Google Chrome 154.0.8037.92 or later, which is the vendor-released fixed version described in the stable channel advisory (https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html); the simplest route is to let Chrome auto-update, then fully restart the browser - closing all windows and confirming via chrome://version that the running build is 154.0.8037.92 or higher, since merely downloading the update does not apply it to a running process. Managed fleets should push the version through their normal browser management tooling and can use Chrome's Relaunch/Update enterprise policies or the update check at chrome://settings/help to force the transition. Because exploitation requires the victim to load attacker-crafted HTML with JavaScript enabled, there is no meaningful configuration workaround that preserves normal browsing: turning off JavaScript or using a JIT-disabling flag would break most sites, and site isolation does not block this renderer-local type confusion. The strongest compensating controls during the exposure window are to keep Chrome fully sandboxed and patched at the OS level (an additional sandbox-escape is needed for host compromise), to restrict browsing to trusted content through network filtering and proxy allow-listing, and to treat any Chrome renderer crash or anomalous behavior as a possible exploitation indicator - accepting that these reduce but do not eliminate risk. Given the High Chromium severity and the ease of delivery via a web page, prioritize the 154.0.8037.92 update over any mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is Chrome's JavaScript and WebAssembly engine, and it compiles hot JavaScript to native code through its JIT tiers; that means any error in how V8 reasons about the runtime type of an object can be converted from a logic bug into native memory corruption. CWE-843 (Type Confusion) describes exactly that failure mode: the engine handles a value as though it were a different type than the one actually allocated, so operations such as property access, element access, or inlined function calls read and write memory at offsets that are valid for the assumed type but not for the real object. In practice this class of bug typically yields out-of-bounds reads and writes and attacker-controlled pointer arithmetic inside the renderer process, which can be turned into arbitrary code execution despite ASLR because the attacker can also build primitives to leak addresses. The affected component is Google Chrome (CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, all platforms and all builds below 154.0.8037.92), per the stable channel advisory and Chromium issue tracker references. The S:U scope score reflects the important architectural boundary here: code execution is achieved in the renderer, which is sandboxed, so the type confusion alone does not cross the process boundary to the host - the sandbox must be escaped separately.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs only a user visit (UI:R) with no privileges (PR:N); type confusion yields in-sandbox code execution (S:U) with high C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome builds prior to 154.0.8037.92 contain a high-severity flaw that could allow a crafted webpage to execute code within the browser’s protected renderer sandbox, putting employees who browse the web with JavaScript enabled at risk. Because the attack is unauthenticated and requires only user interaction, a broad user population is affected; although no public exploit was identified at time of analysis and full system compromise would require an additional sandbox escape, leadership should prioritize rapid patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB