EUVD-2026-67306
GHSA-2rr9-qgh4-qhpv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryTarget user clicks link in Chrome
-
ExploitMalicious JavaScript triggers V8 OOB read
-
ExecutionMemory corruption enables control-flow hijack
-
ImpactArbitrary code executes in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must induce the victim to visit a malicious HTML page using Google Chrome prior to 151.0.7922.72 - user interaction (UI:R) is a hard prerequisite and cannot be bypassed remotely. No authentication by the target is required, and no special server-side configuration of Chrome is needed; the vulnerability is present in default installations. Exploitation is constrained to the Chrome renderer sandbox: arbitrary code execution is achieved within the renderer process, not at the OS or kernel level, which limits the immediate impact to browser-process data (cookies, saved credentials in memory, page content). Sandbox escape would require a separate, unchained vulnerability. SSVC's 'automatable: no' further indicates that reliable, weaponized mass exploitation is not straightforward with this primitive alone. |
| Impact | The CVSS 8.8 score reflects a worst-case impact baseline: network-reachable, low complexity, no privileges, with high confidentiality, integrity, and availability impact. However, several signals collectively moderate real-world urgency. EPSS at 0.30% (22nd percentile) indicates a very low probability of observed exploitation in the near term. SSVC classifies exploitation as 'none' and automatable as 'no,' meaning mass-exploitation campaigns are not anticipated without additional chaining. Critically, the described impact is code execution 'inside the sandbox,' meaning a full compromise of the host system would require a separate sandbox escape primitive not present in this CVE. The Chromium team's internal Medium rating corroborates this constraint. Taken together, the raw CVSS score overstates deployable risk for most organizations: the actual threat requires user interaction, is sandbox-bounded, and currently lacks known exploit code - though SSVC's 'technical impact: total' acknowledges that renderer compromise is a meaningful stepping stone in a multi-stage attack chain. |
| Exploit ScenarioDerived | An attacker hosts a malicious HTML page containing JavaScript crafted to trigger the V8 out-of-bounds read during parsing or JIT compilation. A target user browses to the page using an unpatched Chrome instance - via a phishing link, malvertising, or a compromised legitimate site - causing arbitrary code to execute within Chrome's renderer sandbox. From that foothold, a sophisticated attacker could attempt to chain a separate sandbox escape vulnerability to achieve full host-level compromise, though no such chain is described in available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Out-of-bounds read in V8, Chrome's JavaScript engine, enables remote code execution confined within the renderer sandbox on all platforms running Chrome prior to 151.0.7922.72. The flaw is triggered by a specially crafted HTML page, requiring only that a user visit a malicious site - no authentication or elevated privileges are needed from the attacker. No public exploit code has been identified and no active exploitation is confirmed; EPSS probability stands at 0.30%, aligning with SSVC's 'exploitation: none' classification despite the high CVSS score.
RemediationAI
The primary fix is to update Google Chrome to version 151.0.7922.72 or later via Chrome's built-in updater or from https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise administrators should deploy this update via Google's enterprise management tools or GPO and verify the version string in chrome://settings/help. Organizations unable to update immediately should consider restricting access to untrusted external web content through proxy or DNS filtering controls; however, this does not mitigate the flaw for internal or partially trusted pages. Disabling JavaScript sitewide would prevent exploitation but renders most web applications non-functional and is not a viable long-term workaround. No vendor-issued workaround short of upgrading has been identified in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is the open-source JavaScript and WebAssembly engine embedded in Google Chrome and Chromium-based browsers, processing untrusted web content in a sandboxed renderer process. CWE-125 (Out-of-Bounds Read) describes a memory safety flaw where the engine reads data beyond the allocated buffer boundary during JavaScript execution. In V8, such reads typically occur in JIT compilation paths or object property access routines when type or length assumptions break under adversarial input. While an out-of-bounds read classically suggests information disclosure, in V8's JIT context it can be chained to achieve control-flow hijacking and arbitrary code execution within the sandboxed renderer. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 151.0.7922.72. Chromium's internal severity rating of Medium - lower than the NVD's 8.8 High - likely reflects the sandbox constraint limiting immediate full-system compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via web page, no privileges required, user must visit page (UI:R); scope unchanged because no sandbox escape is described; full RCE impacts within renderer justify C:H/I:H/A:H.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain an out-of-bounds read vulnerability in the V8 JavaScript engine that could enable code execution within the browser sandbox when users visit malicious websites. The vulnerability requires no user authentication or elevated privileges, making any Chrome-using employee a potential target. No public exploit has been identified at this time, but the broad attack surface warrants urgent patching.
Apply vendor patch: Chrome 151.0.7922.72 or later
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB