EUVD-2026-65821
GHSA-jjq9-8qj4-4mq9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryDeliver link to victim via phishing or compromised site
-
ExploitVictim browses page in unpatched Chrome
-
ExecutionJavaScript triggers V8 type confusion
-
PersistExecute arbitrary code in renderer sandbox
-
ImpactChain with sandbox escape for OS-level impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must navigate to or open a crafted HTML page using an unpatched version of Google Chrome (prior to 152.0.7977.65) - user interaction (UI:R) is required per the CVSS vector. No authentication or elevated privileges are required from the attacker (PR:N). Exploitation is limited to the Chrome renderer sandbox; obtaining OS-level access requires chaining with an independent sandbox escape. JavaScript execution is required to trigger the V8 type confusion; environments that completely disable JavaScript would not be vulnerable, though this is impractical for general browser use. No special server-side configuration or non-default Chrome settings are required - any default Chrome installation below the fixed version is vulnerable when browsing attacker-controlled content. |
| Impact | The CVSS 8.8 (High) score reflects network delivery, low complexity, no authentication requirement, and high confidentiality/integrity/availability impact within the renderer. Moderating factors are significant: the EPSS score of 0.33% at the 25th percentile indicates this vulnerability is not currently being exploited at meaningful scale, and there is no CISA KEV listing and no confirmed public exploit code. Critically, the CVE description explicitly states execution is 'inside the sandbox,' meaning this is a renderer compromise, not a full system takeover - chaining with a separate sandbox escape would be required for OS-level impact, raising the realistic attack complexity above what the raw CVSS score suggests. The vendor patch (152.0.7977.65) is already released, narrowing the exploitation window. This is a genuine priority for unpatched Chrome deployments, but the sandbox containment and low EPSS score distinguish it from an immediately critical, weaponized threat. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted JavaScript designed to trigger the V8 type confusion bug. A user on an unpatched version of Chrome visits the page - via phishing link, malvertising, or a compromised website - causing memory corruption in the renderer process that enables arbitrary code execution within the Chrome sandbox. From that renderer foothold, a sophisticated attacker could attempt to chain a separate sandbox escape vulnerability to achieve full OS-level compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Type confusion in V8, Chrome's JavaScript engine, allows remote unauthenticated attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. All Google Chrome desktop versions prior to 152.0.7977.65 are affected across Windows, macOS, and Linux. No public exploit has been identified at time of analysis, and the EPSS score of 0.33% (25th percentile) reflects limited current exploitation probability; the vendor patch is available and should be applied promptly.
RemediationAI
Update Google Chrome to version 152.0.7977.65 or later immediately, as detailed in the stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. Chrome's built-in auto-update mechanism should deliver this patch automatically; confirm the installed version by navigating to chrome://settings/help. For enterprise environments, enforce version compliance via Chrome Browser Cloud Management or Group Policy to ensure fleet-wide patching. Where immediate updating is operationally blocked, restrict end-user access to untrusted external web content through network proxy controls or browser isolation products - note that full JS-blocking is generally impractical as a compensating control in production environments. No workaround fully substitutes for the patch given the network-accessible, user-interaction-only attack surface.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is Google Chrome's high-performance JIT-compiling JavaScript and WebAssembly engine. CWE-843 (Type Confusion) occurs when code allocates or initializes a resource as one type but later accesses it as an incompatible type, enabling memory corruption. In V8, type confusion vulnerabilities typically arise during JIT compilation or object property access, where crafted JavaScript causes V8 to misinterpret an object's type, leading to out-of-bounds reads or writes and potential control-flow hijack. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome releases prior to 152.0.7977.65. The CVSS Scope:Unchanged (S:U) metric confirms that impact is confined to the renderer process and does not inherently constitute a full sandbox escape - a separate sandbox escape primitive would be required to reach the OS.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted page delivered over network (AV:N), no complexity or auth required (AC:L/PR:N), user must visit page (UI:R), impact fully confined to renderer sandbox (S:U).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop versions prior to 152.0.7977.65 contain a type-confusion vulnerability in the V8 JavaScript engine that allows unauthenticated remote code execution within the browser sandbox when users visit crafted web pages. This affects all major platforms (Windows, macOS, Linux) and exploits widespread Chrome deployments across the organization. Immediate patching is required to close an active attack surface, despite current low exploitation probability (EPSS 0.3%).
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB