EUVD-2026-66069
GHSA-v8h3-3x4g-rgpj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description confirms only sandboxed memory reads, so I:N and A:N; C:H reflects potential disclosure of sensitive in-process heap data; sandbox containment keeps S:U.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Type confusion in Chrome's V8 JavaScript engine exposes memory contents within the browser sandbox to remote attackers who can socially engineer victims into visiting a crafted HTML page. All Chrome desktop releases prior to 152.0.7977.65 are affected, confirmed by the Chrome Stable Channel advisory linked in references. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires user interaction: a victim must be socially engineered into visiting an attacker-controlled crafted HTML page (UI:R per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | A significant conflict exists between the vendor-assigned CVSS 8.8 (C:H/I:H/A:H, S:U) and the CVE description, which states the vulnerability only permits reading memory inside the sandbox - implying a Confidentiality impact with no Integrity or Availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious webpage containing JavaScript designed to trigger a type confusion in Chrome's V8 engine, then distributes the link via phishing email, social media, or instant messaging to lure victims. A user on an unpatched Chrome version visits the page, causing V8 to access memory with an incompatible type and allowing the attacker's script to read memory contents within the Chrome renderer sandbox. … |
| Remediation | Vendor-released patch: Chrome 152.0.7977.65. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, communicate the vulnerability to IT and user populations, and assess current Chrome versions in use across the organization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today