EUVD-2026-50915
GHSA-vc8g-6cm2-mwx5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious site
-
DeliveryDeliver crafted HTML/JS page
-
ExploitTrigger V8 type confusion
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactChain sandbox escape for host impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a specially crafted HTML/JavaScript page in a vulnerable Chrome build (prior to 151.0.7922.72) - the CVSS UI:R and the description ('via a crafted HTML page') confirm mandatory user interaction; no authentication or elevated privileges are needed (PR:N). The key limiting factor is that code execution is confined to the renderer sandbox (scope Unchanged, description states 'inside a sandbox'), so host-level compromise requires an additional, separate sandbox-escape vulnerability that this CVE does not provide. Exploitation is further limited by V8 exploit fragility (type-confusion primitives are version- and build-specific) and by Chrome's default auto-update shrinking the window of vulnerable installs. |
| Impact | The signals are mixed and worth separating. CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): network-reachable, low complexity, no privileges, but requiring user interaction (visiting a page) and with scope Unchanged. The Unchanged scope and the description's explicit 'inside a sandbox' wording are the key nuance - code execution is confined to the renderer sandbox and would still need a separate sandbox-escape chain to compromise the host, which is why Chromium labels the severity Low despite the high numeric CVSS. CISA's SSVC framework reinforces a lower urgency: Exploitation 'none', Automatable 'no', Technical Impact 'total'. There is no KEV listing and no POC, so this is currently a serious memory-safety bug without evidence of active exploitation. Given Chrome's ubiquity and V8's historical value in exploit chains, it should be patched promptly through normal browser-update cadence, but it is not a drop-everything emergency absent exploitation signals. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted JavaScript and lures a Chrome user to visit it via phishing, a malicious ad, or a compromised site. When the page loads, the JavaScript triggers the V8 type confusion to gain arbitrary code execution inside the renderer sandbox, positioning the attacker to chain a subsequent sandbox-escape bug for full host compromise. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Arbitrary code execution in Google Chrome's V8 JavaScript engine allows a remote attacker to run code inside the renderer sandbox when a victim visits a crafted HTML page, affecting all desktop builds prior to 151.0.7922.72. The flaw is a CWE-843 type confusion in V8 and carries a CVSS 8.8 due to network reach and high CIA impact, though execution is confined to the sandbox and Chromium rates the security severity as Low. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable Channel update described at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html; Chrome normally auto-updates, so ensure the browser has been fully relaunched to apply the new binary and verify the version under chrome://settings/help. In managed environments, push the update through your existing browser management (Google Admin Console policy, SCCM/Intune, or package repo) and force a restart to complete installation. If patching must be delayed, the practical compensating control is to keep Chrome's site isolation and sandbox enabled (default) and restrict browsing to trusted sites, since exploitation requires the user to load a malicious HTML page; note this only reduces exposure and does not remove the flaw. Users of other Chromium-based browsers should apply their vendor's corresponding V8 update once released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in V8, the just-in-time-compiling JavaScript/WebAssembly engine that powers Chrome and every Chromium-derived browser. CWE-843 (Type Confusion) occurs when the engine allocates or interprets an object as one type while it is actually another, typically through optimizer or garbage-collector edge cases that let attacker-controlled JavaScript violate V8's internal type assumptions. This yields arbitrary read/write primitives in the renderer's address space and ultimately code execution within that process. The single CPE provided, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, confirms the affected component is the Chrome desktop application itself; because the same V8 code is shared, downstream Chromium browsers (Edge, Brave, Opera, Vivaldi) are typically affected until they rebase on the fixed V8.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges but requires the user to visit it (UI:R); scope stays Unchanged because code runs confined within the renderer sandbox.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
A remote code execution vulnerability in Google Chrome's V8 JavaScript engine (CVE-2026-17989) affects all desktop versions prior to 151.0.7922.72, with no public exploit identified at time of analysis. Users are at risk when visiting attacker-controlled websites, potentially enabling data exfiltration, credential theft, and lateral network access from compromised endpoints. Vendor patch version 151.0.7922.72 or later is available and should be deployed urgently to eliminate this attack surface.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome Implementation and Policy Flaws
View all 50Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB