EUVD-2026-41186
GHSA-c598-xgf8-qmvx
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Reachable from any crafted web page (AV:N/AC:L/PR:N) but needs the victim to load it (UI:R); code runs in the sandboxed renderer with total in-process impact and no scope change (S:U, C/I/A:H).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Out-of-bounds write in the V8 JavaScript engine of Google Chrome before 150.0.7871.46 lets a remote attacker achieve arbitrary code execution confined to the renderer sandbox when a victim loads a crafted HTML page. Google rates the Chromium severity as Low, and the aggregate CVSS is 8.8 because impact is total within the compromised process; however no public exploit has been identified at time of analysis and EPSS is only 0.24%. Exploitation requires user interaction (visiting a malicious page) and, on its own, does not escape the sandbox to the underlying OS.
Technical ContextAI
The flaw resides in V8, the C++ JavaScript/WebAssembly engine that powers Chrome and all Chromium-based browsers. The root cause is CWE-787 (Out-of-bounds Write): V8 writes past the bounds of an allocated buffer, typically due to a type-confusion or incorrect bounds/length assumption in JIT-compiled or interpreted code paths driven by attacker-controlled JavaScript. A controlled OOB write in the engine's heap allows an attacker to corrupt adjacent objects and pivot to arbitrary code execution within the renderer process. The affected CPE is cpe:2.3:a:google:chrome, and because the memory corruption is reachable purely from script embedded in an HTML page, any content the browser renders (a website, ad frame, or embedded webview) is a potential trigger.
RemediationAI
Vendor-released patch: update Google Chrome to 150.0.7871.46 or later on the Stable desktop channel, which contains the V8 fix; restart the browser to ensure the new version is loaded, as Chrome applies updates only after a relaunch. Reference the Chrome release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-14395. For managed fleets, push the update via enterprise policy/MDM and verify chrome://version reports at least 150.0.7871.46; downstream Chromium browsers should be updated to the build that incorporates the corresponding V8 patch. If immediate patching is not possible, compensating controls include keeping Chrome's Site Isolation and renderer sandbox enabled (default on - do not disable), restricting browsing to trusted sites, and disabling the V8 JIT optimizer via the JavaScriptOptimizerEnabled enterprise policy, which reduces the JIT attack surface for OOB-write bugs at the cost of slower performance on JavaScript-heavy applications.
Same weakness CWE-787 – Out-of-bounds Write
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today