EUVD-2026-34413
GHSA-52pc-9jv4-4m3g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from an integer overflow in the V8 JavaScript engine, enabling a remote attacker to execute arbitrary code within the renderer sandbox via a crafted HTML page. The flaw is rated High severity by Chromium with a CVSS score of 8.8, requires user interaction (visiting a malicious page), and no public exploit has been identified at time of analysis. While exploitation is sandboxed, V8 RCE bugs historically chain with sandbox escapes to achieve full host compromise, making this a priority patch for browser fleets.
Technical ContextAI
V8 is the open-source JavaScript and WebAssembly engine that powers Chrome, Chromium-based browsers (Edge, Opera, Brave), and Node.js. The root cause maps to CWE-472 (External Control of Assumed-Immutable Web Parameter); however, the description explicitly identifies an integer overflow, a class of arithmetic boundary error (more typically CWE-190) where a calculation exceeds the range of its integer type, producing wrap-around values that can corrupt heap metadata, lead to undersized buffer allocations, and ultimately enable out-of-bounds reads/writes and type confusion within V8's optimizing compiler or runtime. Successful exploitation yields code execution in the renderer process, which is constrained by Chrome's site isolation and OS-level sandboxing, but a fully weaponized chain typically pairs a V8 bug with a separate sandbox escape.
RemediationAI
Vendor-released patch: update Google Chrome to 149.0.7827.53 or later via the Chrome stable channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; managed deployments should force-update via group policy, MDM, or Chrome Browser Cloud Management and verify rollout. Audit and update Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) and any Electron/CEF-embedded applications once their respective vendors ship rebases. If patching cannot occur immediately, compensating controls include disabling JavaScript on untrusted sites via Site Settings or enterprise policy (DefaultJavaScriptSetting), restricting browsing to a curated allowlist (URLBlocklist/URLAllowlist policies), enabling Chrome's Site Isolation if not already on, and blocking known malvertising/exploit-kit infrastructure at the proxy or DNS layer - note that disabling JavaScript globally will break most modern web applications and is typically only viable for high-risk users or kiosks.
Vendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today