EUVD-2026-116438
GHSA-7j9j-665v-873c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
ExploitServe malicious JavaScript to V8
-
ExecutionTrigger type confusion in V8
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to load attacker-controlled web content in a vulnerable Chrome desktop build prior to 157.0.8103.38 - i.e. a crafted HTML page served or injected by the attacker (UI:R / user interaction is the primary limiting factor). No authentication and no non-default configuration are needed (PR:N, default Chrome). The key limiter beyond user interaction is scope: the flaw yields code execution confined to the V8/browser sandbox per the description, so full host compromise would additionally require a separate sandbox-escape vulnerability not covered by this CVE. |
| Impact | Signals mostly converge on a genuine but not top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remote, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted HTML page) - classic browser drive-by profile. CWE-843 type confusion in V8 is a historically high-value, reliably exploitable bug class. Offsetting this, the vuln.today decision label is 'this_week' rather than act_now/emergency, there is no CISA KEV listing and no confirmed public exploit, so active exploitation is not evidenced. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be factored. One important scoping nuance: the description states code execution occurs 'inside the sandbox', meaning a successful trigger yields code execution within the V8/renderer sandbox and would typically require a separate sandbox-escape chain for full host compromise - the 8.8 score reflects in-sandbox impact, not confirmed host takeover. Net: a real, promptly-patchable priority for any Chrome fleet given ubiquity and the V8 type-confusion track record, but not a confirmed in-the-wild emergency on current data. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious JavaScript that triggers the V8 type confusion; a user with a vulnerable Chrome build (prior to 157.0.8103.38) visits it and the attacker potentially achieves arbitrary code execution within the browser sandbox. No authentication is needed, but user interaction (loading the page) is required. No public exploit or PoC is identified in the provided data, though a Chromium issue-tracker reference exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Remote code execution inside the V8 sandbox in Google Chrome allows an unauthenticated attacker to potentially run arbitrary code in the renderer by convincing a user to open a crafted HTML page, affecting desktop builds prior to 157.0.8103.38. Exploitation requires user interaction (UI:R) and remains confined to the browser sandbox unless chained with a separate sandbox escape. No public exploit or CISA KEV listing was identified, and a vendor patch is available in Chrome 157.0.8103.38.
RemediationAI
Upgrade Google Chrome to 157.0.8103.38 or later; the vendor-released patch is documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html and the associated Chromium issue is https://issues.chromium.org/issues/578688670. No vendor-documented workaround is provided in the available references, so updating is the complete fix; ensure the browser is restarted after the update so the new build is active.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a type confusion (CWE-843) in Google Chrome's V8 JavaScript engine, meaning an object can be handled as a type it is not, potentially producing memory corruption during engine operations. The exact trigger is not described in the available sources; the public description only establishes that a crafted HTML page loaded in a vulnerable Chrome build is the delivery vector. CPE data identifies google:chrome with all versions before 157.0.8103.38 affected, and the assessed impact is code execution inside the V8/browser sandbox rather than direct host compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; visiting the page is UI:R; in-sandbox code execution yields high C/I/A with scope unchanged.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity remote code execution vulnerability that could allow an attacker to execute arbitrary code within the browser sandbox when a user visits a malicious webpage. This puts all employees who use Chrome for web browsing at risk, potentially leading to data compromise or further network intrusion if chained with additional exploits. Leadership should prioritize patching to maintain endpoint security and prevent potential operational disruptions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB