EUVD-2026-65999
GHSA-rf3q-pc74-j6jp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML/JS payload
-
DeliveryHost page or inject into ad network
-
ExploitLure victim to visit crafted page
-
ExecutionTrigger V8 race condition via JavaScript
-
ImpactExecute arbitrary code in Chrome renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User interaction is required (UI:R): the victim must actively visit or be redirected to a specifically crafted HTML page in an unpatched Chrome browser - passive network exposure alone is not sufficient. High attack complexity (AC:H) means the race condition in V8 is timing-dependent and cannot be reliably triggered on first attempt; the attacker must engineer precise thread concurrency. No authentication or prior access to the target system is required (PR:N). The vulnerability is constrained by Chrome's renderer sandbox (S:U), meaning successful exploitation grants code execution only within the sandboxed renderer process. All platforms running Chrome prior to 152.0.7977.65 are in scope; no special non-default configuration is required beyond using an affected browser version. |
| Impact | CVSS 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects a high-impact but difficult-to-reliably-trigger vulnerability. The AC:H metric is the key moderating factor: race conditions in JIT-compiled JavaScript engines require precise timing across concurrent threads, making reliable exploitation across heterogeneous CPU architectures and OS schedulers non-trivial. EPSS at 0.24% (15th percentile) aligns with this - exploitation probability is low in the near term. SSVC further confirms exploitation status as none and automatable as no, meaning spray-and-pray attacks at scale are not feasible. Despite SSVC rating technical impact as total, this total impact is bounded by the Chrome sandbox (S:U in CVSS); host-level compromise requires an additional sandbox escape. There is no KEV listing and no reported POC. For most organizations, patch deployment at normal update cadence is sufficient; emergency treatment is not indicated by available signals. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page containing JavaScript designed to win a specific V8 engine race window - for example, triggering concurrent garbage collection and object access - and distributes the link via phishing email or malvertising. When a target visits the page in an unpatched Chrome instance and the race condition fires, the attacker gains arbitrary code execution within the Chrome renderer process sandbox. To progress to full host compromise, the attacker would need to chain a separate sandbox escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Remote code execution within the Chrome sandbox is achievable via a race condition in the V8 JavaScript engine, affecting all Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker (per CVSS PR:N) can trigger the vulnerability by luring a user to a crafted HTML page, exploiting a timing window in V8's memory management to execute arbitrary code. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.24th percentile and CISA SSVC records exploitation status as none, classifying this as a theoretical-but-patched risk for organizations that deploy promptly.
RemediationAI
Upgrade Google Chrome to version 152.0.7977.65 or later - this is the vendor-released patch as documented in the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. Chrome's auto-update mechanism will deliver this to most desktop endpoints without manual intervention; administrators managing enterprise fleets via Group Policy or managed browser configurations should verify update propagation and force a browser restart cycle, as the fix is not applied until the process relaunches. For environments where immediate patching is infeasible, disabling JavaScript execution via enterprise policy (CSSiteTLD/JavaScript blocked) eliminates the V8 attack surface but will break the majority of modern web applications and should be treated as a short-term measure with significant usability trade-offs. Blocking access to untrusted external web content at the network perimeter reduces exposure but does not eliminate risk if attackers can influence internal or trusted sites.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is Google's high-performance JavaScript and WebAssembly engine embedded in Chrome and Chromium-derived browsers. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) describes the root cause: two or more concurrent operations in V8 share an object or memory region without adequate locking, creating a time-of-check to time-of-use (TOCTOU) window. Exploiting such a race requires engineering precise thread scheduling, explaining the CVSS AC:H rating. The CVSS S:U (scope unchanged) reflects that successful exploitation grants code execution within Chrome's renderer sandbox, not directly on the host OS - a full sandbox escape would require chaining an additional vulnerability. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome builds across platforms prior to the fixed version.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via crafted page (AV:N), race condition demands precise timing (AC:H), no auth needed (PR:N), user visit required (UI:R), sandbox-bounded impact (S:U), full triad within sandbox (C:H/I:H/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 152.0.7977.65 contain a remote code execution vulnerability in the V8 JavaScript engine that allows unauthenticated attackers to execute arbitrary code within the browser sandbox via a crafted webpage. While no active exploitation has been observed and vendor patch availability mitigates near-term risk, the ubiquitous deployment of Chrome across the organization makes timely patching essential to prevent potential compromise of user workstations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Same weakness CWE-362 – Race Condition
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB