EUVD-2026-41195
GHSA-f4qh-gr9m-2cmm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with required user interaction and no privileges, but execution is contained to the renderer sandbox so scope is Unchanged (S:U), lowering it below the published 9.6.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Arbitrary code execution within the renderer sandbox in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.46) can be triggered when a victim loads a crafted HTML page. The flaw stems from use of uninitialized memory in V8 and, while carrying a high CVSS base score of 9.6, was rated only Low severity by Chromium because code execution is confined inside the renderer sandbox and still requires a separate sandbox escape for full host compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to load a crafted HTML/JavaScript page in a vulnerable Chrome build (UI:R - user interaction to visit or open the page is mandatory), so there is no drive-by-without-interaction path and no valid target unless the browser is below 150.0.7871.46. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and must be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts or injects a crafted HTML page containing malicious JavaScript that triggers the uninitialized-memory condition in V8; a victim is lured to the page via a phishing link or malvertising and, on load, the attacker gains arbitrary code execution inside the Chrome renderer sandbox. To move from renderer control to full system compromise, the attacker would need to chain a separate sandbox-escape vulnerability. … |
| Remediation | Vendor-released patch: 150.0.7871.46 - upgrade Google Chrome to 150.0.7871.46 or later on all desktop platforms and restart the browser to load the new V8 build, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit current Chrome versions and enable auto-update policies across all endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-457 – Use of Uninitialized Variable
View allShare
External POC / Exploit Code
Leaving vuln.today