EUVD-2026-69735
GHSA-jxq7-x28c-j85p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML/JS page
-
DeliveryVictim visits page in vulnerable Chrome
-
ExploitV8 processes uninitialized resource
-
ExecutionMemory corruption primitive achieved
-
ImpactArbitrary code executes inside Chrome sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | The victim must open a crafted HTML page in a vulnerable Google Chrome build (any version prior to 152.0.7977.75) on a desktop platform. No authentication, no special browser configuration, and no installed extensions are required - standard web browsing to the attacker-controlled page is sufficient to trigger the vulnerability. Exploitation is bounded to code execution within the Chrome renderer sandbox; escalation beyond the sandbox is not part of this CVE. The SSVC 'Automatable: no' classification reflects the required user interaction (UI:R), which prevents fully automated mass exploitation without a social-engineering or malvertising delivery layer. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects a network-delivered, unauthenticated, drive-by attack requiring only a single user page visit - a well-understood and realistic threat model for browser vulnerabilities. SSVC rates Technical Impact as 'total' (full compromise of in-scope process) but Exploitation as 'none' and Automatable as 'no,' the latter because UI:R prevents mass automated exploitation without user interaction. No CISA KEV listing and no public POC have been identified at time of analysis, which meaningfully reduces urgency relative to the raw CVSS score. EPSS data was not provided, leaving probabilistic exploitation likelihood unquantified. The sandbox confinement is a significant mitigating factor: this CVE alone does not grant OS-level access, and a chained sandbox escape would be required for full system compromise. Organizations relying on auto-update channels should confirm propagation; those managing Chrome Enterprise deployments via policy should treat this as a routine but prompt update cycle. |
| Exploit ScenarioDerived | An attacker publishes a malicious web page containing crafted JavaScript designed to trigger the V8 uninitialized resource condition. A user on a vulnerable Chrome version visits the page - whether via phishing link, malvertising, or a compromised legitimate site - causing arbitrary code execution within the Chrome renderer sandbox. No public POC has been identified at the time of analysis, and achieving full OS-level compromise would additionally require a separate sandbox escape primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Remote code execution within the browser sandbox is possible in Google Chrome versions prior to 152.0.7977.75 due to a use-of-uninitialized-resource flaw (CWE-908) in the V8 JavaScript engine. An attacker can trigger the vulnerability by luring a user to a crafted HTML page, with no authentication or special privileges required beyond normal web browsing. Google has released the patched build 152.0.7977.75; SSVC rates exploitation status as none and no CISA KEV listing has been identified at time of analysis.
RemediationAI
Update Google Chrome to version 152.0.7977.75 or later, as documented in the vendor's stable-channel advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html. Users with automatic updates enabled will receive this build without manual action; verify via chrome://settings/help. Chrome Enterprise administrators should deploy the update through their policy management tooling (Google Admin console or GPO) and confirm version compliance across managed endpoints. No documented workarounds exist for this specific V8 flaw - feature-level mitigations such as disabling JavaScript would broadly break site functionality and are not practical compensating controls. Until patching is confirmed, restricting access to untrusted or unvetted web content through proxy filtering or URL categorization policies reduces exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is Google Chrome's high-performance open-source JavaScript and WebAssembly engine. CWE-908 (Use of Uninitialized Resource) describes a condition where allocated memory or a resource is accessed before being properly initialized, potentially exposing attacker-influenced data to program logic in ways that produce memory corruption or type-confusion primitives. In a browser JIT context, uninitialized state in V8 can be shaped by attacker-controlled JavaScript to redirect execution flow. The affected versions are confirmed via the EUVD entry as Chrome builds prior to 152.0.7977.75. Exploitation is confined to the renderer sandbox process; achieving OS-level impact would require a separate sandbox escape primitive not described in this CVE.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered drive-by via crafted page, no auth needed, user visit required (UI:R), scope unchanged (sandbox boundary holds), full in-sandbox C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 152.0.7977.75 contain a use-of-uninitialized-resource vulnerability in the V8 JavaScript engine that enables remote code execution when users visit a crafted webpage. The attack requires no authentication-any user browsing the web is at risk-and affects organizations globally across all deployed Chrome instances. Immediate patching is critical to prevent potential compromise of user systems and data accessed through the browser.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome 152 Memory Safety and Authorization Flaws
View all 26Same weakness CWE-908 – Use of Uninitialized Resource
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB