Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
We need to generate a JSON with specific fields. Let's analyze the input.
CVE-2026-16418: Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182. Allows remote attacker to execute arbitrary code inside a sandbox via crafted HTML page. Chromium security severity: High.
CVSS: 8.8, vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-121: Stack-based Buffer Overflow
EPSS: 0.22% (13th percentile) - low. Patch: Available from vendor. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. Tags: RCE, Google, Buffer Overflow, Stack Overflow CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (likely all versions before 150.0.7871.182) Affected versions (EUVD): ["Chrome 150.0.7871.182 <150.0.7871.182"] — this is odd, maybe they mean versions prior to 150.0.7871.182. It says "Chrome 150.0.7871.182 <150.0.7871.182" which is likely a formatting issue, should mean versions < 150.0.7871.182. References include Chrome releases blog and Chromium issue.
Multi-source intelligence: no mention of KEV, so no active exploitation confirmed. POC? Not mentioned. So no public exploit identified.
Now, product_name: "Google Chrome" is specific enough. One to three words. "Google Chrome" is fine.
Summary: Need an original synthesis. Not copy description. Start with impact verb and product. So "Remote code execution inside sandbox in Google Chrome prior to 150.0.7871.182 allows a remote attacker to execute arbitrary code via a crafted HTML page due to a stack buffer overflow in V8." Mention not actively exploited, no POC, EPSS low. Keep 2-3 sentences. So: "Remote code execution inside the Chrome sandbox via a crafted HTML page is possible due to a stack buffer overflow in the V8 JavaScript engine. Google Chrome versions before 150.0.7871.182 are affected. No public exploit or active exploitation is known at this time, and the EPSS exploitation probability is low (0.22%)."
Technical_context: Explain V8, stack buffer overflow (CWE-121). CPE indicates all Chrome versi
Same weakness CWE-121 – Stack-based Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-47573
GHSA-mrwj-q3p7-wc59