EUVD-2026-65819
GHSA-p9jj-rhrj-6p8w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via browser visit (AV:N/UI:R), no privileges or auth needed (PR:N), sandbox confinement prevents scope change (S:U), memory corruption yields full CIA impact within renderer.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the sandboxed renderer process in all Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker can trigger arbitrary code execution by luring a user to a crafted HTML page, with full high-impact across confidentiality, integrity, and availability within the sandbox boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a target user to actively visit a crafted HTML page in an affected Chrome version (prior to 152.0.7977.65) - consistent with CVSS UI:R. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity, network-delivered exploitation requiring only that a user visit a malicious page, with high CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a website and embeds crafted JavaScript designed to trigger a type confusion condition in Chrome's V8 engine. A target visiting the page in an unpatched Chrome browser causes the JIT compiler to mishandle object types, resulting in memory corruption that allows arbitrary code execution within the Chrome sandboxed renderer process. … |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later using the browser's built-in update mechanism (Menu → Help → About Google Chrome) or via enterprise software management tooling (Google Update, Intune, etc.). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify the number of Chrome instances across your organization and verify your update delivery mechanism is functional. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today