EUVD-2026-105459
GHSA-879w-2jj2-h624
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitDeliver malicious HTML/JS to V8
-
ExecutionTrigger memory corruption in V8
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome prior to 156.0.8078.47 (desktop or ChromeOS) and to visit attacker-controlled content - the crafted HTML page is the required delivery vector, reflected in UI:R. No authentication or special non-default configuration is needed, as V8 JavaScript execution is enabled by default. The key limiting factors are: (1) mandatory user interaction (the victim must load the malicious page), and (2) the compromise is contained within the renderer sandbox (S:U), so full host compromise realistically requires chaining with an additional sandbox-escape vulnerability. |
| Impact | This is a genuine high-priority patch item but with an important caveat that tempers the raw score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) indicates a network-reachable, low-complexity, unauthenticated bug that only requires user interaction (visiting a crafted page). However, the description explicitly states code execution occurs 'inside the sandbox' and scope is Unchanged (S:U) - meaning this is a renderer-level compromise, not a full host takeover, and would typically need to be chained with a separate sandbox-escape to fully own the machine. No EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. Treat as high priority for routine browser patching given ubiquitous deployment and Google's 'High' severity rating, but it is not a confirmed in-the-wild emergency on the available data. EPSS and KEV data are absent, not low - their absence should not be read as 'safe.' |
| Exploit ScenarioDerived | A remote attacker lures a victim into visiting a malicious or compromised web page containing crafted HTML/JavaScript that triggers a memory-corruption flaw in Chrome's V8 engine. Successful exploitation yields arbitrary code execution within the renderer sandbox, which an attacker would typically pair with a separate sandbox-escape to reach the underlying OS. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the V8 JavaScript engine allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the browser's renderer sandbox by convincing a victim to load a crafted HTML page in Google Chrome versions prior to 156.0.8078.47 (desktop and ChromeOS). Exploitation requires user interaction (the victim must open the malicious page), and because the CVSS scope is unchanged, the resulting compromise is confined to the renderer sandbox - full host takeover realistically requires chaining with a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, though the engine-level memory corruption primitive, the high CVSS score of 8.8, and Chrome's status as a high-value mass-market target make this a priority patch item; Google credits the flaw as reported by chrome-cve-admin@google.com and rates it Chromium security severity High.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 (or later) on desktop and to the corresponding fixed ChromeOS stable build referenced in https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html; verify the build string in chrome://version and fully restart the browser (and any ChromeOS device) so the new renderer and V8 binaries actually load, since stale processes can keep the vulnerable engine resident. For managed fleets, pin a minimum-version policy through Chrome Enterprise (e.g. a version-enforced update policy with an auto-update grace window of hours rather than the default days), which enforces the patch but costs you the ability to hold back on future releases; note that no meaningful feature-level workaround exists because the defect sits in V8, which must run for essentially all web content, and disabling JavaScript would break most sites while still leaving the engine reachable via privileged internal pages. Compensating controls, with trade-offs: keep Site Isolation and the renderer sandbox enabled (default) to contain the impact to a single renderer - disabling it for performance or compatibility removes the primary defense-in-depth layer against this class of bug; on high-risk browsing or kiosk profiles, restrict navigation to an allowlist of trusted origins to shrink exposure to attacker-controlled HTML at the cost of user flexibility; and segment privileged users so a renderer compromise cannot be paired with an easily reachable second-stage sandbox escape. Because no public exploit code is currently identified, standard patching cadence is acceptable, but treat this as a fast-turnaround update given the confirmed High severity rating and the possibility of an in-the-wild chain emerging later.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is Chrome's JavaScript and WebAssembly engine; it compiles attacker-supplied script into optimized machine code through tiers such as Sparkplug, Maglev and TurboFan, and manages a garbage-collected heap inside the renderer process. The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), the parent class covering out-of-bounds reads and writes and related heap corruption. In practice, a bounds or type-confusion style defect in V8's object model or JIT-generated code lets a crafted HTML/JavaScript payload corrupt memory that the engine then uses as an object pointer, converting script-level input into controlled native code execution - but only within the privileges of the renderer. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects that the attack is network-delivered and needs no credentials, yet demands the victim load the page (UI:R), and that the high confidentiality/integrity/availability impact is scored as contained to one security authority (S:U) rather than crossing into the OS. That is precisely why the practical threat model is a renderer-sandbox compromise plus a chained second bug for host escape.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; a victim must open the page (UI:R); code stays in the renderer sandbox so S:U with high C/I/A.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop and ChromeOS versions prior to 156.0.8078.47 contain a high-severity memory corruption flaw in the V8 engine that can let a remote attacker execute code within the browser's renderer sandbox when a user opens a crafted page. Although exploitation requires user interaction and the sandbox confines the initial compromise-full host takeover realistically requires chaining with a separate sandbox-escape flaw-Chrome's broad deployment and the high CVSS score of 8.8 make this a priority patch for organizational endpoint fleets. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a vendor patch.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB