EUVD-2026-65819
GHSA-p9jj-rhrj-6p8w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page with malicious JavaScript
-
DeliveryTarget visits page in unpatched Chrome (< 152.0.7977.65)
-
ExploitV8 type confusion triggered during JavaScript object access
-
ExecutionMemory corruption achieved in renderer process
-
ImpactArbitrary code executed within Chrome sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a target user to actively visit a crafted HTML page in an affected Chrome version (prior to 152.0.7977.65) - consistent with CVSS UI:R. No authentication, login, or special browser configuration is required; default Chrome installations across all supported platforms are susceptible. The primary limiting factors are: mandatory active user interaction (the user must navigate to the attacker's page or be redirected), Chrome's renderer sandbox boundary (S:U per CVSS), which confines initial code execution to the renderer process and does not directly yield OS-level access, and the SSVC 'not automatable' rating, indicating reliable mass-exploitation of this specific type confusion primitive is non-trivial. No non-default feature toggle or specific OS version is identified as a prerequisite in the available data. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity, network-delivered exploitation requiring only that a user visit a malicious page, with high CIA impact. However, two signals significantly temper real-world urgency: EPSS is just 0.27% (19th percentile), and SSVC rates exploitation as 'none' and automatable as 'no' - both consistent with the absence of a CISA KEV listing or publicly identified POC. The divergence between CVSS severity and EPSS probability is characteristic of browser V8 bugs that are theoretically severe but require sophisticated JIT exploitation techniques, making reliable mass exploitation non-trivial. The unchanged scope (S:U) is a meaningful containment factor, as initial compromise is bounded by Chrome's sandbox and does not inherently achieve OS-level code execution without a separate sandbox escape. Priority should follow standard browser patch cadence rather than emergency response, though organizations with high-risk user populations (finance, government, executives) may choose to expedite. |
| Exploit ScenarioDerived | An attacker registers or compromises a website and embeds crafted JavaScript designed to trigger a type confusion condition in Chrome's V8 engine. A target visiting the page in an unpatched Chrome browser causes the JIT compiler to mishandle object types, resulting in memory corruption that allows arbitrary code execution within the Chrome sandboxed renderer process. No public POC has been identified at time of analysis, reducing the likelihood of immediate commodity exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the sandboxed renderer process in all Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker can trigger arbitrary code execution by luring a user to a crafted HTML page, with full high-impact across confidentiality, integrity, and availability within the sandbox boundary. No active exploitation is confirmed in CISA KEV, and EPSS sits at a low 0.27% (19th percentile), though vendor and SSVC both rate technical impact as total, warranting prompt patching as part of routine browser update cadence.
RemediationAI
Update Google Chrome to version 152.0.7977.65 or later using the browser's built-in update mechanism (Menu → Help → About Google Chrome) or via enterprise software management tooling (Google Update, Intune, etc.). The vendor advisory is at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. For environments where immediate patching is not feasible, the most effective compensating control is restricting end-user navigation to untrusted or unknown HTML pages via web proxy URL filtering or DNS-based content controls - note this requires enforcement at the network layer to be effective, and does not protect against attacker-controlled content on otherwise-trusted domains. Chrome's existing sandbox provides partial containment, limiting post-exploitation scope to the renderer process, but does not prevent the initial compromise. No workarounds are known to directly mitigate the V8 type confusion condition itself without patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is Google Chrome's open-source JavaScript and WebAssembly engine, responsible for JIT compilation and object property management. CWE-843 (Type Confusion) arises when code allocates or initializes a resource under one type but subsequently accesses it as an incompatible type - in V8, this typically manifests in the JIT compiler or object shape-tracking subsystems where incorrect type assumptions lead to out-of-bounds memory reads or writes. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome releases across platforms prior to the patched build 152.0.7977.65. Because V8 processes untrusted web content, a type confusion flaw is reachable via crafted JavaScript in any HTML page without requiring elevated privileges or special browser configuration.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via browser visit (AV:N/UI:R), no privileges or auth needed (PR:N), sandbox confinement prevents scope change (S:U), memory corruption yields full CIA impact within renderer.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 152.0.7977.65 contain a type confusion vulnerability in the V8 JavaScript engine that enables remote code execution within the renderer sandbox when users visit malicious websites. All organizations depend on Chrome for web access, making this a critical browser security issue affecting millions of endpoints. Immediate updates are essential to prevent unauthorized code execution and protect organizational data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB