EUVD-2026-50851
GHSA-mh8j-cw3w-4f8w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious JavaScript triggers V8 type confusion
-
ExploitCorrupt object memory layout
-
ExecutionGain arbitrary read/write primitive
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load a crafted HTML/JavaScript page in an unpatched Google Chrome before 151.0.7922.72 - the UI:R metric means user interaction (navigating to the malicious page) is mandatory, so there is no zero-click path. No authentication or elevated privileges are required (PR:N). The key limiting factors are: (1) the victim must actively visit or be redirected to attacker-controlled content, (2) code execution is confined to the renderer sandbox (S:U), so a chained sandbox escape is needed for host-level compromise, and (3) the target must be running a vulnerable Chrome build, since the patched 151.0.7922.72 release closes the flaw. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) reflects a network-reachable, low-complexity, unauthenticated bug whose only gate is user interaction (visiting a page). Critically, the description states code execution occurs 'inside a sandbox' and the scope is Unchanged (S:U) - meaning successful exploitation compromises only the renderer process, and a separate sandbox-escape chain would be required for full host compromise, which meaningfully lowers standalone real-world impact. The EPSS score is low (0.28%, 20th percentile) and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; this is a genuine but not emergency priority. The signals are consistent rather than conflicting: high CVSS driven by memory-corruption impact, but tempered by the sandbox boundary and low current exploitation probability. V8 type-confusion bugs historically attract exploit development and have been chained in the wild, so patching promptly remains warranted despite the currently low EPSS. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious JavaScript that triggers the V8 type-confusion condition, then lures a victim via phishing, malvertising, or a watering-hole link. When the victim opens the page in an unpatched Chrome, the crafted script corrupts memory and executes attacker code within the renderer sandbox; the attacker would then need a separate sandbox-escape to reach the host. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated High by Chromium with a CVSS of 8.8, the flaw requires only that the user visit a malicious site; no authentication is needed but user interaction is. There is no public exploit identified at time of analysis, and the low EPSS score (0.28%, 20th percentile) suggests exploitation is not yet widespread.
RemediationAI
Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the built-in updater (Chrome menu > Help > About Google Chrome, then relaunch) and confirm the fixed build is running, as detailed in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update through enterprise policy/MDM and force a browser restart to apply it. If immediate patching is not possible, reduce exposure by enabling Chrome's site isolation and 'Enhanced' Safe Browsing, restricting browsing of untrusted sites, and considering JavaScript restrictions on high-risk profiles via enterprise policy - with the trade-off that disabling or limiting JavaScript breaks many legitimate web applications and is disruptive as a broad control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-843 Type Confusion in V8, the C++ JavaScript and WebAssembly engine embedded in Chrome and all Chromium-derived browsers. Type confusion occurs when the engine's optimizing compiler or runtime treats a memory object as a different type than it actually is, letting attacker-controlled JavaScript manipulate object shapes so a subsequent operation reads or writes memory using an incorrect type layout. This yields a powerful memory corruption primitive that is commonly escalated to arbitrary read/write and ultimately code execution. The single CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected component is the Chrome application itself; because V8 is shared, other Chromium browsers (Edge, Brave, Opera, Electron apps) are typically affected by the same class of bug even though only Google Chrome is enumerated here.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page (AV:N/AC:L/PR:N) needs the user to visit it (UI:R); renderer-sandboxed RCE keeps scope unchanged (S:U) with full C/I/A impact on that process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A high-severity flaw in Chrome's V8 JavaScript engine (versions before 151.0.7922.72) enables remote code execution when users visit malicious websites, potentially giving attackers access to sensitive data and system resources. The vulnerability affects all Chrome users across the organization, creating material risk of data breach and unauthorized system access. A vendor patch is available and should be deployed immediately.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB