EUVD-2026-54131
GHSA-xc4c-849c-886m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable via web page (AV:N), no special complexity beyond a crafted page (AC:L), unauthenticated (PR:N), requires victim to open page (UI:R), confined to renderer sandbox with no scope change (S:U), full CIA impact within the sandbox (C:H/I:H/A:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution within the Chrome renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.109 through an out-of-bounds write flaw in the V8 JavaScript engine, triggerable by a crafted HTML page. An unauthenticated remote attacker needs only to lure a victim to a malicious page, achieving code execution confined to the sandboxed renderer process. No public exploit or active exploitation has been identified at time of analysis; however, the CVSS 8.8 score and SSVC total technical impact classification indicate significant potential consequences if exploitation is developed.
Technical ContextAI
The flaw resides in V8, Google Chrome's high-performance, open-source JavaScript and WebAssembly engine implemented in C++. CWE-787 (Out-of-Bounds Write) identifies the root cause: V8 writes data beyond the allocated bounds of a memory buffer during processing of JavaScript content embedded in a crafted HTML page. This class of memory corruption vulnerability can overwrite adjacent heap or stack structures, enabling attackers to hijack control flow and direct execution to attacker-controlled code. The affected product is Google Chrome desktop prior to version 151.0.7922.109, as confirmed by EUVD-2026-54131. No CPE strings were supplied in the source data, so product scope is derived from the vendor advisory and EUVD affected-version range. The Chromium security severity is rated High, consistent with the NVD CVSS 8.8 base score.
RemediationAI
The primary remediation is to upgrade Google Chrome to version 151.0.7922.109 or later, as released via the Google stable channel update documented at http://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome auto-updates silently on most consumer endpoints; enterprise administrators using managed policies (e.g., Google Admin Console, GPO, or Intune) should verify that update policies are not blocking deployment and force a policy refresh if needed. As a compensating control prior to patching, organizations can restrict employee browsing to allowlisted domains via web proxy or DNS filtering, which prevents access to attacker-controlled pages at the cost of significant user productivity impact and incomplete coverage of compromised legitimate sites. Disabling JavaScript entirely would eliminate the V8 attack surface but is impractical for any operational environment. No workaround substitutes for the vendor patch.
Same weakness CWE-787 – Out-of-bounds Write
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today