Skip to main content

Google CVE-2026-16418

| EUVDEUVD-2026-47573 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-07-21 chrome-cve-admin@google.com GHSA-mrwj-q3p7-wc59
8.8
CVSS 3.1 · Vendor: google
Share

Severity by source

Vendor (google) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE
CRITICAL
qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 26, 2026 - 12:01 vuln.today
CVSS changed
Jul 24, 2026 - 13:22 NVD
8.8 (HIGH)
CVE Published
Jul 21, 2026 - 23:16 cve.org
HIGH 8.8
CVE Published
Jul 21, 2026 - 23:16 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

We need to generate a JSON with specific fields. Let's analyze the input.

CVE-2026-16418: Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182. Allows remote attacker to execute arbitrary code inside a sandbox via crafted HTML page. Chromium security severity: High.

CVSS: 8.8, vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-121: Stack-based Buffer Overflow

EPSS: 0.22% (13th percentile) - low. Patch: Available from vendor. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. Tags: RCE, Google, Buffer Overflow, Stack Overflow CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (likely all versions before 150.0.7871.182) Affected versions (EUVD): ["Chrome 150.0.7871.182 <150.0.7871.182"] — this is odd, maybe they mean versions prior to 150.0.7871.182. It says "Chrome 150.0.7871.182 <150.0.7871.182" which is likely a formatting issue, should mean versions < 150.0.7871.182. References include Chrome releases blog and Chromium issue.

Multi-source intelligence: no mention of KEV, so no active exploitation confirmed. POC? Not mentioned. So no public exploit identified.

Now, product_name: "Google Chrome" is specific enough. One to three words. "Google Chrome" is fine.

Summary: Need an original synthesis. Not copy description. Start with impact verb and product. So "Remote code execution inside sandbox in Google Chrome prior to 150.0.7871.182 allows a remote attacker to execute arbitrary code via a crafted HTML page due to a stack buffer overflow in V8." Mention not actively exploited, no POC, EPSS low. Keep 2-3 sentences. So: "Remote code execution inside the Chrome sandbox via a crafted HTML page is possible due to a stack buffer overflow in the V8 JavaScript engine. Google Chrome versions before 150.0.7871.182 are affected. No public exploit or active exploitation is known at this time, and the EPSS exploitation probability is low (0.22%)."

Technical_context: Explain V8, stack buffer overflow (CWE-121). CPE indicates all Chrome versi

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Package Hub 15 SP7 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Package Hub 15 SP7 Affected

Share

CVE-2026-16418 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy