EUVD-2026-54270
GHSA-5xc2-jccc-h5f2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via any web page; no privileges needed; user must visit the page (UI:R); sandbox boundary holds (S:U), but full impact within the renderer process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution within the V8 JavaScript engine affects Google Chrome prior to 151.0.7922.109, allowing a remote attacker to execute arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page. The flaw stems from an inappropriate implementation in V8 (CWE-693, Protection Mechanism Failure), carrying a CVSS 8.8 rating with high confidentiality, integrity, and availability impact. No public exploit code has been identified and CISA SSVC confirms no active exploitation at time of analysis, though the technical impact is rated total by SSVC, underscoring the severity if exploited.
Technical ContextAI
V8 is Google's open-source JavaScript and WebAssembly engine, embedded in Chrome and Chromium-based browsers. CWE-693 (Protection Mechanism Failure) indicates that a security control within V8 - likely a bounds check, type check, or JIT compilation guard - was not correctly implemented, creating a pathway to execute attacker-controlled code within the renderer process sandbox. The affected product version range is Chrome prior to 151.0.7922.109, as confirmed by EUVD-2026-54270 and the Chrome stable channel release advisory. Because V8 processes all JavaScript encountered on any web page, the attack surface is extremely broad and does not require any non-default browser feature.
RemediationAI
Update Google Chrome to version 151.0.7922.109 or later, the vendor-released patch confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome typically auto-updates, but administrators managing enterprise fleets should verify deployment via Google Update or applicable MDM policy and confirm version 151.0.7922.109 is installed. As a compensating control prior to patching, restricting access to untrusted or external web content (e.g., via web proxy category filtering) reduces exposure, though this is operationally disruptive. Disabling JavaScript broadly would prevent exploitation but is not practical in most environments. No workarounds equivalent to the patch exist; expedited update deployment is the only fully effective mitigation.
Same weakness CWE-693 – Protection Mechanism Failure
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today