EUVD-2026-54139
GHSA-vc67-62qr-jvwf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted webpage with no authentication needed (PR:N), but passive victim interaction is required (UI:R); sandbox containment prevents scope change (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Remote code execution within the Chrome sandbox via an integer overflow in the V8 JavaScript engine affects Google Chrome prior to version 151.0.7922.109. An unauthenticated remote attacker can trigger the flaw by enticing a user to visit a specially crafted HTML page, resulting in full compromise of confidentiality, integrity, and availability within the renderer process. No public exploit code has been identified and CISA SSVC confirms exploitation status as none, though the total technical impact and low attack complexity elevate real-world priority for patching.
Technical ContextAI
V8 is Google Chrome's high-performance JavaScript and WebAssembly engine, responsible for parsing and executing all JavaScript content loaded by the browser. CWE-190 (Integer Overflow or Wraparound) occurs when arithmetic on integer values produces a result exceeding the representable range, causing the value to wrap around unexpectedly. In V8, such overflows can corrupt memory allocations or object metadata, enabling an attacker to gain control of execution flow. The vulnerability affects all Chrome desktop builds prior to 151.0.7922.109, as confirmed by the EUVD affected version range 'Chrome 151.0.7922.109 <151.0.7922.109'. The sandbox architecture limits the immediate blast radius to the renderer process, but RCE within the sandbox can serve as a stepping stone to full system compromise when chained with a sandbox escape.
RemediationAI
The primary fix is to update Google Chrome to version 151.0.7922.109 or later, which is confirmed available via the vendor's stable channel release advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome's built-in auto-update mechanism should deliver this patch automatically on most desktop systems; administrators managing enterprise deployments via Google Admin or policy tools should verify rollout completion. As a compensating control prior to patching, restricting access to untrusted or external web content via browser policies (e.g., site isolation enforcement, disabling JavaScript on untrusted origins) can reduce exposure, though these controls impose usability trade-offs and are not a substitute for patching. Organizations using Chrome in kiosk or locked-down modes should prioritize update verification, as those environments may suppress auto-update.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today