EUVD-2026-34672
GHSA-5m5w-xxc6-6j93
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from an integer overflow in the V8 JavaScript engine that allows a remote attacker to execute arbitrary code within the renderer sandbox via a crafted HTML page. The flaw requires user interaction (visiting a malicious page) and currently has no public exploit identified at time of analysis, with an EPSS score of 0.04% indicating very low near-term exploitation probability. Chromium rates the security severity as Medium despite the 8.8 CVSS score, and SSVC indicates no observed exploitation though technical impact is total.
Technical ContextAI
The vulnerability resides in V8, Chrome's open-source JavaScript and WebAssembly engine that compiles and executes JS code from web pages. CWE-472 (External Control of Assumed-Immutable Web Parameter) is the classified weakness type, though the description points to an integer overflow - a numeric calculation producing a value outside the representable range, which in V8 typically leads to undersized buffer allocations, out-of-bounds reads/writes on typed arrays or JIT-compiled code, and ultimately memory corruption exploitable for code execution. Because V8 is also embedded in Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) and Electron-based applications, downstream products inherit the same defect until they uptake the upstream fix. The execution is bounded by the Chrome renderer sandbox, meaning a successful exploit yields code execution inside the sandboxed renderer process rather than full host compromise without a separate sandbox escape.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.53 or later on the Stable desktop channel - the vendor-released patch is referenced in the Chrome Releases blog post (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html) and tracked in Chromium issue 506629455. For most users Chrome's auto-update mechanism delivers this on restart; enterprise fleets using managed update policies should confirm the rollout reached endpoints and force a relaunch where users defer restarts. Users of Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) and Electron apps should track the respective vendor advisories for the V8 rebase. As a compensating control until patching, restrict browsing to trusted sites via enterprise policy or URL filtering, or enable Chrome's Site Isolation and Enhanced Safe Browsing - note that disabling JavaScript site-wide would mitigate V8 exposure but breaks most modern web applications and is impractical for general use.
Vendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today