EUVD-2026-41188
GHSA-rrr3-5825-8cg8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page reached with no auth (AV:N/PR:N) but needs the victim to open it (UI:R); code stays in the renderer sandbox so scope is unchanged (S:U) with full C/I/A within that process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution in Google Chrome's V8 JavaScript engine (all channels prior to 150.0.7871.46) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a CWE-843 type-confusion bug rated High by Chromium and CVSS 8.8; there is no public exploit identified at time of analysis and CISA's SSVC framework marks exploitation status as none. Because CVSS is AV:N/PR:N with UI:R, exploitation is unauthenticated but requires the victim to open a malicious page.
Technical ContextAI
V8 is Chrome's JavaScript and WebAssembly engine, which JIT-compiles untrusted script from any visited web page. CWE-843 (Type Confusion) occurs when the engine allocates or interprets an object as one type but later operates on it as another, allowing an attacker to violate memory-type assumptions and gain a read/write primitive over engine internals. In V8 this class of bug typically stems from optimizer mis-speculation or incorrect object-shape handling and is a recurring, highly weaponizable pattern. The affected component is identified by CPE cpe:2.3:a:google:chrome:*, and the crash/tracking detail is referenced at chromium issue 523884658.
RemediationAI
Vendor-released patch: update Google Chrome to 150.0.7871.46 or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html, then fully restart the browser so the new V8 build loads. In managed fleets, force the update through enterprise policy/auto-update and confirm the reported version. As an interim compensating control before patching, restrict exposure by disabling the V8 JIT optimizer (e.g. via the --js-flags="--no-opt" launch flag or the JavaScript JIT enterprise policy), which removes a common type-confusion trigger surface at the cost of degraded JavaScript performance, and advise users to avoid untrusted sites; site isolation and the renderer sandbox remain in effect and limit blast radius. Users of other Chromium-based browsers should apply their vendor's build incorporating the equivalent V8 fix.
Vendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today