EUVD-2026-89397
GHSA-9x63-2qqh-fp92
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryV8 parses malicious JavaScript/HTML
-
ExploitTrigger stack buffer overflow in V8
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactStage sandbox-escape for full host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires user interaction (UI:R): the victim must open or be navigated to an attacker-controlled crafted HTML page in an unpatched Chrome build prior to 154.0.8037.92. No authentication or special privileges are needed (PR:N) and the default browser configuration is sufficient - no non-default feature must be enabled. The primary limiting factor is that successful code execution is confined to the renderer sandbox (S:U), so full host compromise additionally requires chaining a separate sandbox-escape vulnerability; the drive-by interaction requirement and the sandbox boundary are the main practical constraints on impact. |
| Impact | All signals align on a genuine but not emergency-level browser RCE. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity, unauthenticated flaw needing only that a victim load a crafted HTML page, with full impact but NO scope change (S:U) - matching the description's key qualifier that code executes 'inside the sandbox.' This is a first-stage V8 memory-corruption primitive that still requires a separate sandbox-escape chain to compromise the host, which tempers real-world severity versus a S:C sandbox-escape sibling. CISA's SSVC framework corroborates this triage: Exploitation=none (no observed activity), Automatable=no (drive-by still needs victim navigation/interaction), Technical Impact=total. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Chromium's internal 'High' (not Critical) rating is consistent with a sandboxed-only outcome. Net: a real patch-now priority for any Chrome fleet given ubiquity and drive-by delivery, but not a confirmed-exploited zero-day - prioritize by deployment breadth rather than by active-threat urgency. |
| Exploit ScenarioDerived | An attacker hosts or injects (via malvertising or a compromised site) a crafted HTML page that drives V8 into a stack-based buffer overflow when the victim's Chrome renders it. With low attack complexity and no authentication, a single visit gives the attacker arbitrary code execution within the renderer sandbox, which is typically chained to a further sandbox-escape bug to reach the host. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
A stack-based buffer overflow (CWE-121) in the V8 JavaScript engine allows remote code execution inside the renderer sandbox of Google Chrome builds prior to 154.0.8037.92 when a victim is lured to a crafted HTML page. Exploitation requires user interaction - the target must open or be navigated to the attacker-controlled page - but no authentication or privileges are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and the default browser configuration is sufficient. No public exploit code or active exploitation has been identified, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no'; the practical ceiling on impact is the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. All signals align on a genuine but not emergency-level browser RCE, and Google has shipped a vendor patch.
RemediationAI
Vendor-released patch: Chrome 154.0.8037.92 or later. Upgrade affected desktop deployments to 154.0.8037.92+ using the standard Chrome update mechanism (Help > About Chrome) or by pushing the packaged build through your enterprise software-distribution or Chrome Browser Cloud Management pipeline; the fix is documented in the September 2026 stable-channel advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html, with technical detail tracked at https://issues.chromium.org/issues/563716534. Because exploitation is driven by drive-by HTML rendering, interim compensating controls are mitigations rather than fixes: enforce an aggressive auto-update/relaunch policy so browsers cannot persist on older builds across a restart (side effect: forced relaunches disrupt user sessions and open tabs); enable site isolation and keep it enabled to maximize containment if the overflow is triggered (already default on desktop, so little additional gain against this specific bug); and restrict or monitor untrusted web browsing on high-value hosts via network egress filtering, DNS/proxy policy, or a separate low-privilege browsing environment (side effect: significant usability and operational friction for general productivity users). Given that renderer compromise alone does not equal host compromise, prioritize patching on administrative, developer and other high-value workstation populations rather than treating this as an emergency fleet-wide outage-class event; no vendor-released workaround eliminates the overflow without the version upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in V8, Chrome's JavaScript/WASM engine, and is classified as CWE-121, a stack-based buffer overflow - memory corruption in which data written past a fixed-size stack buffer can overwrite adjacent control data such as saved return addresses or frame pointers. Because V8 runs untrusted JavaScript inside the renderer process, a successful overflow converts attacker-supplied script from a template or crafted HTML page into control-flow hijacking within the renderer, yielding arbitrary code execution at the privilege level of the renderer but contained by Chrome's site-isolation sandbox. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the fixed threshold at 154.0.8037.92; the Chromium severity rating is High and the tagged issue is tracked as a stack overflow with RCE potential. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms the attack is network-delivered, low-complexity, unauthenticated, and requires victim interaction, with scope unchanged - i.e., confidentiality, integrity and availability impacts are confined to the renderer, not the host OS, absent a chained escape.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs only a victim visit (AV:N/AC:L/PR:N/UI:R); code runs inside the sandbox with no scope change (S:U) but full renderer impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A high-severity stack-based buffer overflow in Google Chrome's V8 JavaScript engine could allow an unauthenticated remote attacker to execute code within the browser's renderer sandbox if a user is lured to a malicious webpage. Although no public exploit identified at time of analysis and the sandbox limits impact to the browser process, the widespread use of Chrome and the low complexity of user-interaction attacks make timely remediation critical. Leadership should ensure all Chrome installations are updated to vendor-released patch: 154.0.8037.92 or later to protect organizational data and users.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB