EUVD-2026-27975Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft malicious HTML page
-
DeliveryDeliver via phishing or compromised site
-
ExploitUser opens page in Chrome
-
InstallV8 parses and executes JavaScript
-
C2Object lifecycle mishandling occurs
-
ExecuteOut-of-bounds memory read executes
-
ImpactSensitive data extracted from memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated exploitation requires the following specific conditions: the user must open a crafted HTML page containing malicious JavaScript in Google Chrome prior to version 148.0.7778.96. The vulnerability cannot be triggered without user interaction (UI:R in CVSS vector) - spontaneous remote exploitation over the network without user clicking a link or visiting a site is not possible. The vulnerability affects all Chrome installations below the patched version on all supported desktop platforms (Windows, macOS, Linux) with no identified configuration or feature flag that either enables or disables the vulnerability. The V8 JavaScript engine is always active in Chrome's standard configuration and cannot be disabled without breaking browsing functionality. |
| Impact | Risk assessment reveals a moderate but manageable threat. CVSS 4.3 with AV:N/AC:L/PR:N indicates remote network access with low complexity, but UI:R (user interaction required) and C:L/I:N/A:N (confidentiality impact only, no integrity or availability impact) limit real-world severity. EPSS data not provided, but the confidentiality-only impact combined with mandatory user interaction suggests this is less critical than network-exploitable remote code execution vulnerabilities. The Chromium security severity rating of 'Medium' aligns with the CVSS score. Active exploitation status not confirmed (KEV status unknown from input), but as a Chrome vulnerability, weaponization risk exists given Chrome's ubiquity. The exploit requires victim interaction, reducing likelihood of large-scale automated attacks. Organizations where users cannot be reliably restricted from visiting untrusted sites face higher risk than those with strict web access controls. |
| Exploit ScenarioDerived | An attacker hosts a malicious website containing specially crafted HTML and JavaScript code that triggers the object lifecycle issue in V8. When a user visits the page (via phishing email, malvertising, or watering hole attack), the JavaScript executes within the Chrome sandbox, causing the memory read vulnerability. The attacker extracts sensitive data from adjacent memory regions such as authentication tokens, encryption keys, or data from other browser tabs. The exploitation succeeds only if the user opens the malicious page; there is no network propagation or cross-origin exploitation beyond the visited site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 06, 2026
Out-of-bounds memory read in Google Chrome's V8 JavaScript engine allows remote attackers to disclose sensitive information via a crafted HTML page. Affects Chrome versions prior to 148.0.7778.96. The vulnerability requires user interaction (opening a malicious page) but operates over the network with no authentication required. While classified as medium severity by Chromium, the impact is limited to information disclosure without code execution capability.
RemediationAI
Update Google Chrome to version 148.0.7778.96 or later immediately. Users can verify their Chrome version by navigating to chrome://settings/help, which will automatically check for and install available updates. Chrome typically auto-updates on a schedule (weekly for most users), but manual installation via chrome://settings/help or reinstallation from google.com/chrome ensures immediate patching. No workarounds exist for this vulnerability since it requires browser code changes; however, users who cannot immediately patch should avoid opening links from untrusted sources and consider disabling JavaScript in high-risk scenarios via browser extensions (such as NoScript), though this substantially impacts web functionality. Organizations can force Chrome updates via Group Policy (Windows) or Mobile Device Management (macOS/Linux) to ensure rapid patch deployment across their user base. The vendor advisory is available at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in V8, Google's open-source JavaScript engine embedded in Chrome, and stems from an object lifecycle management issue (CWE-125: Out-of-bounds Read). V8 manages memory for JavaScript objects through a complex garbage collection and reference counting system. The flaw allows an attacker to craft malicious HTML/JavaScript that triggers improper object lifecycle handling, resulting in memory access beyond allocated buffer boundaries. This permits reading adjacent memory contents that may contain sensitive data. The vulnerability is specific to Chrome's rendering engine and JavaScript execution layer, not a general V8 library issue, as indicated by the Chrome-specific advisory and Chromium issue tracker reference.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Object lifecycle issue in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
GitHub PoC
Exploit-DB