EUVD-2026-41195
GHSA-f4qh-gr9m-2cmm
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with required user interaction and no privileges, but execution is contained to the renderer sandbox so scope is Unchanged (S:U), lowering it below the published 9.6.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Arbitrary code execution within the renderer sandbox in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.46) can be triggered when a victim loads a crafted HTML page. The flaw stems from use of uninitialized memory in V8 and, while carrying a high CVSS base score of 9.6, was rated only Low severity by Chromium because code execution is confined inside the renderer sandbox and still requires a separate sandbox escape for full host compromise. No public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation status as none.
Technical ContextAI
The vulnerability lives in V8, the C++ JavaScript and WebAssembly engine that powers Chrome and all Chromium-derived browsers. The root cause is classified as CWE-457 (Use of Uninitialized Variable): a code path reads a memory location before it has been assigned a defined value, letting attacker-influenced residual heap or stack contents drive control flow or object state. In a JIT-compiling engine like V8 this typically manifests as type-confusion or corrupted object metadata that an attacker massages into a controlled read/write primitive and ultimately arbitrary code execution within the renderer process. The affected component per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Chrome desktop application across all versions below the fixed build.
RemediationAI
Vendor-released patch: 150.0.7871.46 - upgrade Google Chrome to 150.0.7871.46 or later on all desktop platforms and restart the browser to load the new V8 build, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. In managed environments, verify auto-update is enabled and not blocked by policy, and push the update via your enterprise management tooling. If immediate patching is not possible, reduce exposure by restricting browsing of untrusted sites, keeping Chrome's Site Isolation (default) and Enhanced Safe Browsing enabled to limit malicious-page delivery, and considering the strictest JavaScript/JIT hardening available (for example running V8 jitless via --js-flags or the equivalent enterprise policy where supported); note that disabling JIT measurably degrades performance on JavaScript-heavy sites. Ensure Chromium-derived browsers are updated on the same timeline.
Same weakness CWE-457 – Use of Uninitialized Variable
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today