EUVD-2026-74469
GHSA-75jh-cw99-rpg7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:N and PR:N correct for extension distribution; UI:R required for extension installation; S:U reflects sandbox containment with no scope change.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)
AnalysisAI
Memory corruption in V8, Chrome's JavaScript engine, allows an attacker who can get a user to install a crafted Chrome extension to execute arbitrary code confined within the Chrome sandbox, affecting all Chrome versions prior to 153.0.8010.36. Despite the CVSS 8.8 base score, Chromium's own security team rates this 'Low' severity, reflecting that exploitation is bounded by Chrome's sandbox and does not constitute a full OS-level compromise without a separate sandbox escape primitive. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target user must install a crafted Chrome extension created by the attacker - this is the mandatory delivery prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8 High, but the Chromium security team's own 'Low' severity rating is a material signal that the risk is overstated in isolation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Google Chrome to version 153.0.8010.36 or later via the built-in updater or from https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, assess Chrome deployment scope in your organization and verify patch version 153.0.8010.36 is available in your update channel. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-119 – Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today