EUVD-2026-116425
GHSA-449g-f2p5-43cx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
DeliveryDeliver malicious JavaScript to V8
-
ExploitTrigger type confusion (CWE-843) in V8 engine
-
ExecutionCorrupt object memory and gain control
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in Chrome prior to 157.0.8103.38 - the CVSS UI:R and the description ('via a crafted HTML page') confirm user interaction (visiting/rendering a malicious page) is mandatory; there is no drive-by-without-navigation vector described. No authentication or special privileges are needed (PR:N), and no non-default configuration is required since V8/JavaScript execution is on by default. A key LIMITING factor: the vector is S:U and the description states code executes 'inside the sandbox,' so this flaw alone yields only renderer-sandbox compromise - escaping to the host would require chaining with a separate sandbox-escape vulnerability. The precise trigger mechanism of the type confusion is not described in the available sources. |
| Impact | Signals are mixed and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a user open a crafted HTML page - characteristic of browser memory-corruption bugs. The SSVC framework, however, reports Exploitation: none and Automatable: no, with Technical Impact: total, and the vuln.today decision label is 'this_week' rather than act_now/emergency. The CVE is NOT in CISA KEV and no EPSS score was supplied, so exploitation probability cannot be quantified from the input. There is no confirmed public exploit: the only Chromium issue-tracker link (issues.chromium.org/577318603) is a bug reference, not verified working exploit code. Crucially, the description states code execution 'inside the sandbox' and the vector is S:U (scope unchanged) - meaning successful exploitation yields renderer-process compromise, not host takeover, absent a separate sandbox-escape chain. Net: a legitimately high-severity V8 type-confusion bug in a ubiquitous product that warrants prompt patching, but current signals (no KEV, SSVC exploitation none, no EPSS) indicate it is not yet known to be exploited and is not trivially automatable. Treat it as a near-term patch priority consistent with the 'this_week' label, not a drop-everything emergency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious JavaScript that triggers the V8 type-confusion condition when rendered by an unpatched Chrome (<157.0.8103.38). A victim who merely visits the page can have attacker-controlled code executed within the browser's renderer sandbox. No public, verified exploit code was identified in the provided data; a Chromium issue-tracker entry exists but is a bug reference, not a confirmed PoC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Type confusion in Chrome's V8 JavaScript engine, affecting Chrome builds prior to 157.0.8103.38, allows a remote unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is gated by user interaction (the victim must navigate to and render attacker-controlled content), and because the CVSS vector is S:U with the description explicitly scoping code execution 'inside the sandbox,' this flaw alone yields renderer-level compromise rather than host takeover - escaping to the operating system would require chaining with a separate sandbox-escape bug. No public exploit has been identified at time of analysis (SSVC Exploitation: none, Automatable: no), no CISA KEV listing exists, and a vendor patch is available, placing it in a this-week rather than emergency remediation window.
RemediationAI
Vendor-released patch: 157.0.8103.38 - Google shipped the fix in the stable channel update documented at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html, and any Chrome installation below that build (per the EUVD range) must be brought to 157.0.8103.38 or later. No workaround or configuration-level mitigation is described in the available sources; the vendor fix is the remediation, and deployment of the updated build should be verified fleet-wide rather than assumed from auto-update, since the browser must be relaunched after the update is staged. Where immediate fleet-wide upgrading is not possible, the exposure window is bounded by the user-interaction prerequisite (the victim must actually load attacker-controlled content) and by renderer sandbox confinement, meaning a compromise stays inside the sandbox unless chained with a separate sandbox-escape vulnerability - this reduces but does not eliminate urgency, and the Chromium issue tracker entry (https://issues.chromium.org/issues/577318603) should be monitored for further detail on the flaw and any additional guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a type confusion (CWE-843) in V8, Chrome's JavaScript and WebAssembly engine, reached through a crafted HTML page. Type confusion means an object is handled as a type it is not, so property accesses and element reads/writes are performed against the wrong memory layout; in a JIT-optimizing engine like V8 this class of bug typically enables memory corruption that can be shaped into arbitrary read/write and then code execution. The supplied evidence does not describe the specific code path, optimization stage, or object types involved, so the precise trigger mechanism is not described in the available sources. Severity is rated High by Chromium and 8.8 by CVSS (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): network-reachable, no privileges required, no non-default configuration needed because JavaScript execution is enabled by default, but requiring victim navigation to attacker-controlled content. The S:U scope plus the 'inside the sandbox' wording confines impact to the renderer sandbox; the affected package is tracked generically as cpe:2.3:a:google:chrome and classified under memory-corruption/RCE tags.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no auth (PR:N) but requires the user to open it (UI:R); V8 type confusion gives full renderer control (C/I/A:H) but stays in-sandbox, so S:U.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a high-severity type confusion flaw in the V8 JavaScript engine that enables remote attackers to achieve renderer-level code execution when a user visits a malicious webpage. Although confined to the browser sandbox and requiring user interaction, this vulnerability puts all users of unpatched Chrome builds at risk and warrants prioritized remediation within the standard weekly patch cycle.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB