EUVD-2026-100640
GHSA-fhjp-2mcc-3364
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitDeliver malicious JavaScript to V8
-
ExecutionTrigger type confusion in V8
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Google Chrome build prior to 155.0.8059.79 and to actively load attacker-controlled web content (UI:R / crafted HTML page) - a drive-by or malicious-site/ad delivery. No authentication is required (PR:N). Two significant limiting factors reduce realistic risk: (1) mandatory user interaction (navigating to the malicious page), and (2) the resulting code execution is confined to the renderer sandbox (scope unchanged, S:U), so a separate sandbox-escape chain is needed for host-level compromise. Chrome's default automatic update mechanism also shortens the real-world exposure window. |
| Impact | Signals point to a genuinely serious but not immediately urgent issue. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) describes a remote, low-complexity, unauthenticated vulnerability requiring only that a victim load a crafted HTML page, with high confidentiality, integrity and availability impact. However, these signals must be tempered by context the raw score omits: the description states code executes 'inside the sandbox', meaning this V8 type-confusion flaw yields renderer-level RCE that is still contained by the Chromium sandbox and would need to be chained with a separate sandbox-escape to achieve full host compromise. The low-probability exploitation signals corroborate restraint: EPSS is only 0.23% (13th percentile), the CVE is NOT on CISA KEV, and CISA SSVC records Exploitation=none and Automatable=no (though Technical Impact=total, consistent with code execution). No POC is referenced. These lower-urgency signals are consistent with each other and do not conflict with the high CVSS - the score reflects worst-case impact, while EPSS/SSVC reflect current real-world activity. Net: patch on the normal Chrome auto-update cycle; this is a credible browser RCE building block, not an actively weaponized emergency. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) that triggers the V8 type-confusion flaw when a victim using a pre-155.0.8059.79 Chrome visits it, achieving arbitrary code execution within the renderer sandbox. No public exploit identified at time of analysis, and the victim must actively navigate to attacker-controlled content; full system compromise would additionally require chaining a separate sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Type confusion in the V8 JavaScript engine of Google Chrome allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.79. Exploitation requires no credentials (PR:N) but does require user interaction - the target must navigate to or be served attacker-controlled web content - and the resulting code execution remains confined to the renderer process, so a separate sandbox escape would be needed for host-level compromise. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile); Google has released a patched build and Chrome's automatic update mechanism shortens the practical exposure window.
RemediationAI
Upgrade Google Chrome to 155.0.8059.79 or later - Vendor-released patch: 155.0.8059.79 - which is delivered through Chrome's normal auto-update channel (verify via chrome://settings/help and force a restart to apply the staged build); Extended Stable users should take the separate extended-stable update referenced at https://chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html, and the Stable advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html. Because the bug is in V8 itself there is no configuration switch that removes the attack surface, so patching is the only complete fix. Interim compensating controls, with trade-offs: keep the renderer sandbox and Site Isolation enabled (disabling either would turn a sandbox-confined RCE into host compromise, so this must not be relaxed despite compatibility complaints); constrain exposure by enforcing URL allow/deny lists and safe-browsing/enterprise policies so users are less likely to reach attacker-controlled pages, accepting reduced browsing reach as the cost; and accelerate update compliance through enterprise update policies (e.g., shortened auto-update deadlines / forced relaunch) since the primary practical risk is unpatched browsers remaining on pre-155.0.8059.79 builds - the side effect being disruptive browser restarts for users. Note that the requirement for user interaction (UI:R) means phishing-style lures or malicious ad delivery are the realistic vector, so user-awareness and ad-blocking measures have marginal, not decisive, value compared with patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-843 type confusion inside V8, Chrome's JavaScript engine, which compiles and optimizes untrusted script via TurboFan/Maglev-style JIT pipelines. Type confusion occurs when an object created or cast as one type is later dereferenced as an incompatible type, corrupting the engine's internal representation of heap objects; in a JIT engine this typically yields out-of-bounds read/write primitives and, from there, controlled code execution. The issue was reported to the Chromium project by chrome-cve-admin@google.com and is tracked as Chromium issue 562038980, though as is standard for Chrome security fixes the technical specifics are restricted until most users have updated. Impact is bounded by Chrome's multi-process sandbox: the corrupted code runs in the renderer, matching the assessed vector's unchanged scope (S:U) and the need for a chained sandbox escape for full system compromise. CPE strings were not supplied in the source data; the EUVD record identifies the vulnerable build as Chrome versions earlier than 155.0.8059.79.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable crafted page, low complexity, no auth but requires the victim to visit (UI:R); scope stays Unchanged because code is confined to the renderer sandbox.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome builds prior to 155.0.8059.79 carry a type confusion flaw in the V8 JavaScript engine that allows a crafted web page to run attacker-controlled code inside the browser's renderer sandbox. Because Chrome is a primary business application across the enterprise and the only user action required is visiting or being served a malicious page, essentially every web-browsing employee represents a potential entry point - though the sandbox confines initial code execution to the browser tab, so host-level compromise would require a second, separate exploit. No public exploit code or active exploitation has been observed and EPSS is very low, making this a time-sensitive but routine browser update rather than a crisis; leadership should care because unmanaged, auto-update-disabled, and pinned-build endpoints may remain exposed well beyond Chrome's normal update cycle.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB