EUVD-2026-91710
GHSA-28xg-w882-xvjx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitMalicious JS triggers V8 type confusion
-
ExecutionCorrupt object memory in renderer
-
ImpactExecute arbitrary code in sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 154.0.8037.97 to navigate to or load attacker-controlled crafted HTML/JavaScript (UI:R) - there is no server-side or unattended vector. No authentication is required (PR:N). The key limiting factor is that code execution is confined to the renderer sandbox (scope Unchanged); without an additional sandbox-escape vulnerability, the attacker cannot reach the host OS or data outside the browser process, and site-isolation further constrains cross-origin impact. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - the classic browser drive-by profile. However, the description explicitly states code execution occurs 'inside the sandbox,' and scope is Unchanged (S:U), meaning a successful exploit alone does NOT escape Chrome's renderer sandbox or compromise the host OS; a separate sandbox-escape bug would be needed for full system compromise. This materially tempers real-world impact versus the raw 8.8 score. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no POC is referenced, so this is currently 'no public exploit identified at time of analysis' - distinct from active exploitation. V8 type-confusion bugs (CWE-843) are historically high-value and frequently weaponized into exploit chains by advanced actors, so the latent risk is real, but on present signals this is a high-severity patch-promptly issue rather than a confirmed emergency. Google rates Chromium severity 'High,' consistent with this assessment. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious JavaScript that triggers the V8 type-confusion flaw. A victim running Chrome prior to 154.0.8037.97 simply visits the page (user interaction = navigation), and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code is referenced, and full host compromise would require chaining a separate sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Type confusion in the V8 JavaScript engine of Google Chrome allows remote code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page, affecting all versions prior to 154.0.8037.97 (Chromium severity: High, CVSS 3.1 base 8.8). Exploitation is unauthenticated but requires user interaction (UI:R) - the victim must navigate to or render attacker-controlled HTML/JavaScript - and code execution is confined to the sandbox with scope Unchanged, so escaping to the host OS would require a separate sandbox-escape flaw and site isolation further limits cross-origin reach. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available.
RemediationAI
Vendor-released patch: upgrade to Google Chrome 154.0.8037.97 or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html (also reachable at http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html), and verify the version in chrome://version after the update; Chromium-based browsers generally ingest the fix once they rebase onto the corresponding Chromium release. Until patching is complete, the only meaningful compensating control is reducing exposure to the attack surface that triggers the V8 type confusion: disable the JavaScript JIT in managed deployments using the --js-flags="--jitless" launch flag (or enterprise policy equivalents on ChromeOS), which removes the optimizing-compiler path this class of bug abuses but imposes a substantial performance penalty on JavaScript-heavy and WebAssembly workloads; alternatively, keep Strict Site Isolation enabled (it does not prevent the renderer compromise but confines cross-origin reach) and restrict browsing to trusted internal sites until the update can be rolled out. Note that the CVSS vector requires user interaction, so blocking unattended or embedded web content rendering and prompt browser restart enforcement are useful tactical measures, and no workaround fully substitutes for applying the 154.0.8037.97 patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-843 type confusion defect in V8, Chrome's JavaScript/WASM engine. Type confusion in V8 typically arises when the optimizing JIT compiler (TurboFan/Maglev) or an inline cache makes an incorrect assumption about an object's map (hidden class) and then treats a value as a different, incompatible type, allowing an attacker to craft JavaScript that reads or writes memory with attacker-controlled layout - a classic primitive for turning a scripting-engine bug into arbitrary code execution within the renderer process. The affected product is captured by the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with EUVD entry EUVD-2026-91710 recording affected builds as Chrome versions below 154.0.8037.97. The issue is tracked upstream as Chromium issue 559893859 and was reported by Chrome, indicating disclosure through the regular Chrome stable channel update rather than an external researcher report. Because the flaw is exploited through a crafted web page, it fits the drive-by browser attack model: a remote, unauthenticated attacker (AV:N/AC:L/PR:N) needs only the victim to render hostile HTML (UI:R), and the resulting code execution stays inside the renderer sandbox (S:U) unless chained with a separate escape.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges (AV:N/PR:N) but victim must visit it (UI:R); renderer code execution yields high C/I/A yet no sandbox escape, so scope stays Unchanged.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A high-severity security flaw in Google Chrome (versions before 154.0.8037.97) could allow attackers to execute malicious code within the browser when users visit compromised or malicious websites. While the browser's sandbox limits the impact to the browser environment, a successful exploit could lead to data theft, session hijacking, or further compromise if combined with other vulnerabilities. There is currently no public exploit identified at time of analysis, but a vendor patch is available, so immediate remediation is essential to protect organizational data and user privacy.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB