EUVD-2026-102516
GHSA-f9ch-27pc-gjcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitDeliver malicious JavaScript to V8
-
ExecutionTrigger memory corruption in V8
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user of Google Chrome prior to 155.0.8059.84 to load attacker-controlled HTML content in the browser (CVSS UI:R) - there is no fully autonomous/no-interaction path. No authentication or privileges are needed (PR:N), and default Chrome configurations are affected since V8 JavaScript execution is enabled by default. The key limiting factors are: (1) mandatory user navigation to malicious/compromised content, and (2) the explicit statement that code execution occurs 'inside the sandbox' (S:U), so meaningful host compromise additionally requires a separate renderer sandbox escape not covered by this CVE. |
| Impact | This is a genuine high-priority patch item but not a drop-everything emergency based on current signals. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U, score 8.8) indicates a remotely reachable, low-complexity flaw needing no privileges but requiring user interaction - consistent with the 'crafted HTML page' delivery (victim must visit a malicious/compromised page). Signals partially conflict: CVSS and the 'total' SSVC technical impact suggest severe consequences, yet SSVC Exploitation is 'none' and Automatable is 'no', and no EPSS score, KEV listing, or POC is provided, so there is no evidence of active or automated exploitation. Critically, the description states code execution is 'inside the sandbox' (S:U, no scope change) - meaning a successful exploit lands in the renderer/V8 sandbox and would still require a separate sandbox-escape chain for full host compromise, tempering real-world severity. Net: treat as a routine-urgent browser update (V8 memory-corruption RCE in an ubiquitous product) rather than an emergency; prioritize via normal Chrome auto-update cadence unless a sandbox-escape chain or in-the-wild use emerges. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page containing crafted content that triggers the V8 memory-corruption bug; a victim running a vulnerable Chrome (<155.0.8059.84) visits the page and the attacker achieves arbitrary code execution within the renderer sandbox. Because UI:R applies, the attack depends on the user navigating to attacker-controlled content (e.g., via phishing, malvertising, or a compromised site). No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Memory corruption in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 lets a remote, unauthenticated attacker achieve arbitrary code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (CVSS UI:R) - the target must navigate to attacker-controlled or compromised web content - and no public exploit code has been identified at time of analysis, with CISA SSVC rating current exploitation as 'none'. Because the code execution is explicitly confined to the sandbox (S:U), full host compromise would require chaining a separate sandbox-escape vulnerability, making this a high-priority patch item rather than an emergency.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.84 or later, which is the exact fixed version identified in the vendor and EUVD data; the primary path is to allow Chrome's built-in auto-update to complete and restart the browser, or push the update through enterprise management (for example Google Update / Chrome Browser Cloud Management policies) with a forced relaunch. Confirm the applied build by checking chrome://version against 155.0.8059.84 and verify the corresponding Chrome stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html. No separate workaround exists for the underlying V8 memory-corruption flaw, and disabling JavaScript is not operationally viable; the practical compensating controls are Chrome's renderer sandbox and Site Isolation, which contain the impact to the renderer process and mean host-level compromise additionally requires a chained sandbox escape - so treat timely update as the real mitigation. Organizations that cannot patch immediately should consider temporarily restricting browsing to trusted sites or running high-risk browsing in a disposable/isolated environment, accepting the trade-off of reduced usability and incomplete protection, and should prioritize users who routinely visit untrusted or third-party content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a memory-safety defect (CWE-119, improper restriction of operations within the bounds of a memory buffer) in V8, Chrome's JavaScript and WebAssembly engine, which is enabled by default in every desktop Chrome build. V8 compiles and JIT-optimizes untrusted JavaScript; a bounds or lifetime error in that pipeline can let attacker-supplied script corrupt heap memory and hijack control flow within the renderer process. CPE data (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) confirms the affected component is Chrome broadly, with the vendor's own description narrowing the vulnerable window to releases prior to 155.0.8059.84 and Chromium classifying the security severity as High. Critically, the description states the resulting code execution is 'inside the sandbox,' meaning the compromise is contained in the renderer's OS-level sandbox - escaping to the host, reading arbitrary files, or persisting would require a second, independent sandbox-escape bug not covered by this CVE. The associated tags (RCE, Buffer Overflow, Google) and the Chromium issue reference (issues.chromium.org/issues/569659194) are consistent with a classic V8 out-of-bounds/type-confusion class bug patched in a routine stable-channel update.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page delivery (AV:N, AC:L, PR:N) requires the victim to open the page (UI:R); code runs within the sandboxed renderer (S:U) with high C/I/A in that context.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A memory-corruption flaw in Google Chrome's V8 JavaScript engine (CVE-2026-110920, CVSS 8.8) allows a crafted web page to execute attacker-controlled code inside the browser's renderer sandbox on any unpatched endpoint. Because Chrome is broadly deployed across the workforce and exploitation only requires a user to browse to malicious or compromised content, the exposure covers essentially the entire browsing population, although sandbox isolation means full host takeover would require chaining a separate escape vulnerability. No public exploit code has been identified at time of analysis (no CISA KEV listing), making this a high-priority patch item rather than an emergency, and a vendor-released patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB