EUVD-2026-89387
GHSA-pm2f-26p8-mcc2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious JS triggers V8 type confusion
-
ExploitCorrupt object type interpretation
-
ExecutionExecute arbitrary code in renderer sandbox
-
Impact(chain sandbox escape for full host compromise)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open an attacker-controlled or compromised web page in Google Chrome prior to 154.0.8037.92 (UI:R - user interaction to load the page). No authentication, no special browser configuration, and no non-default features are needed - V8 is the always-on JavaScript engine, so any HTML/JS-rendering context is a viable trigger. The primary LIMITING factors are: (1) user must navigate to the malicious page, and (2) resulting code execution is confined to the renderer sandbox (S:U), so full host compromise requires chaining a separate sandbox-escape vulnerability. |
| Impact | This is a genuine high-priority vulnerability, though signals are mixed on urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U, C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page - the classic drive-by RCE profile, corroborated by the RCE and Memory Corruption tags and CWE-843 (type confusion), a bug class V8 exploiters routinely weaponize. However, the impact is bounded: the description states code executes 'inside the sandbox' (consistent with S:U, no scope change), so on its own it is not a full sandbox escape and would need to be chained with a sandbox-escape bug to fully compromise the host. CISA's SSVC framework rates Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=total, which aligns with the absence of any KEV listing, EPSS score, or public POC in the provided data. Chromium's internal severity is 'High' (not Critical), reinforcing that this is a serious-but-not-emergency issue. Net: real priority for patching given ubiquitous deployment and the reliability of V8 type-confusion exploitation, but there is no evidence of active exploitation or automation at time of analysis. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious web page containing crafted JavaScript that triggers the V8 type-confusion condition when the victim's Chrome (before 154.0.8037.92) renders it, causing the engine to misinterpret an object's type and yielding arbitrary code execution within the renderer sandbox. No authentication is needed and complexity is low, but the victim must actually load the page (UI:R), and the attacker would need a separate sandbox-escape to break out to the host. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Type confusion in V8, Chrome's JavaScript engine, allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page in Google Chrome versions prior to 154.0.8037.92. Exploitation requires user interaction (CVSS PR:N/UI:R) - the target must navigate to attacker-controlled or compromised content - and no public exploit code has been identified at time of analysis, with CISA's SSVC assessment recording Exploitation = none. Because V8 is the always-on JavaScript engine, any HTML/JS-rendering context is a viable trigger with no special configuration needed, but the resulting code execution is confined to the renderer sandbox (S:U), so full host compromise requires chaining a separate sandbox-escape vulnerability.
RemediationAI
Upgrade Google Chrome to 154.0.8037.92 or later - this is the vendor-released fix version carrying the V8 type-confusion correction, distributed through the stable channel per the advisory at chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html; verify the installed version under Chrome's About page and fully restart the browser, since Chrome applies updates on relaunch and a stale running process remains vulnerable. Where immediate fleet-wide upgrade is not possible, the practical compensating control is to disable JavaScript by default via the enterprise policy DefaultJavaScriptSetting=2 (or per-site JavaScript blocking), which removes the trigger surface entirely because the bug is reachable only through script execution in V8 - the trade-off is that most modern web applications will break, making this suitable only for tightly scoped, low-functionality kiosk or high-risk user populations. Locking users to an allowlisted set of trusted sites (URLBlocklist/URLAllowlist policies) reduces exposure to attacker-controlled pages but requires ongoing curation and can be bypassed by compromised first-party content. Chrome's renderer sandbox already contains the impact of this bug at the process level, so it limits but does not eliminate risk: successful exploitation still yields code execution inside the sandbox, and defenders should treat any confirmed hit as a potential precursor to a sandbox-escape chain, pairing the upgrade with host-level detection for unusual renderer-process behavior. No patch-independent workaround fully neutralizes the flaw; the version upgrade is the definitive remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-843, Type Confusion, in V8, Chrome's JavaScript engine. In this class of bug, the engine (typically in the optimizing JIT compiler tiers) makes an incorrect assumption about the runtime type of an object - for example, treating a value as one internal representation while the attacker has arranged for it to be another - and then performs memory accesses based on that stale or wrong type. The practical consequence in V8 is memory corruption: out-of-bounds reads/writes or corrupted object maps that an attacker can shape into arbitrary code execution inside the renderer process. The affected component is identified by the generic CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with a wildcard version, and the EUVD entry (EUVD-2026-89387) records the fixed baseline as 154.0.8037.92, meaning all Chrome builds below that release carry the flaw. Chromium rates the security severity as High, and the fix landed through the stable channel; the associated Chromium issue tracker entry (issues.chromium.org/issues/560536732) is the authoritative technical record, though like most V8 memory-corruption bugs the exploit primitive details are typically withheld until the majority of users have updated.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no auth or special config (AV:N/AC:L/PR:N) but a page visit (UI:R); code stays in-sandbox so S:U with full renderer C/I/A:H.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A high-severity type confusion flaw in Google Chrome's V8 JavaScript engine (CVE-2026-102328) allows a malicious web page to run attacker-controlled code inside the browser's renderer process on any unpatched Chrome installation prior to 154.0.8037.92. Because Chrome is widely deployed across the workforce and the attack only requires a user to open a crafted page, this represents a broad, low-effort entry point for attackers, though the code execution remains confined to the renderer sandbox and full endpoint compromise would require an additional exploit. Leadership should prioritize this as a routine but urgent patch-management action affecting all Chrome users, including remote and BYOD populations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB