EUVD-2026-70702
GHSA-84qv-4wj5-wwmm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page with malicious JavaScript
-
DeliveryVictim visits page via phishing, ad redirect, or compromised site
-
ExploitJavaScript triggers V8 type confusion bug
-
ExecutionHeap memory corrupted with attacker-controlled type layout
-
PersistArbitrary code executes inside Chrome renderer sandbox
-
ImpactRenderer data (credentials, session tokens, DOM) accessible to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special server-side configuration is required - any Chrome version prior to 152.0.7977.82 on desktop is vulnerable by default. The sole prerequisite is user interaction: the victim must navigate to or be redirected to an attacker-controlled HTML page (UI:R per CVSS). JavaScript must be enabled in Chrome, which is the default configuration in all standard deployments. Exploitation results in code execution confined to Chrome's renderer sandbox (S:U); the attacker cannot directly access the host operating system, the filesystem, or other processes without an additional sandbox-escape primitive not described in this CVE. There is no requirement for a specific Chrome feature flag, extension, or non-default setting to be enabled. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the threat model: network-reachable exploitation requiring only that the victim visit a malicious page, with no authentication or complex precondition. Exploitation is bounded by Chrome's renderer sandbox (S:U), meaning an attacker achieves code execution inside the renderer but not automatically on the host OS - a full system compromise would require a separate sandbox-escape primitive. Despite this scoping, sandboxed renderer RCE is a valuable and frequently sought-after primitive in browser exploit chains, and attackers regularly pair it with local privilege escalation. The low attack complexity (AC:L) signals that once a working type confusion primitive is established, reaching reliable exploitation is not a high bar for a skilled attacker. No EPSS data, no CISA KEV entry, and no public POC are present in the provided intelligence, so the immediate observed threat level is moderate; however, even a mid-sized municipal IT team in mielec should treat this as urgent given Chrome's ubiquitous presence and the historical pattern of V8 bugs being weaponized within days of public disclosure. Rapid patching via Chrome's auto-update is the correct response at all organizational scales. |
| Exploit ScenarioDerived | An attacker constructs a web page containing JavaScript engineered to trigger the V8 type confusion bug - for instance, causing V8 to treat a Float64Array object as a JS object reference, enabling relative heap reads and writes. A victim browsing Chrome visits the page (via phishing link, malvertising redirect, or compromised legitimate site), and the script executes arbitrary code in the renderer process, potentially exfiltrating cookies, passwords stored in the browser, or serving as a staging point for a follow-on sandbox escape. No public POC has been identified at time of analysis, but the low attack complexity (AC:L) indicates a reliable exploit path once the root cause is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Type confusion in V8 (Chrome's JavaScript engine) in versions prior to 152.0.7977.82 enables unauthenticated remote attackers to execute arbitrary code within Chrome's renderer sandbox by enticing a user to visit a specially crafted HTML page. The flaw exploits V8's type system, allowing an attacker to manipulate object type metadata in the JavaScript heap to gain controlled memory access and code execution inside the renderer process. No public exploit or CISA KEV listing has been identified at time of analysis, though V8 type confusion vulnerabilities in Chrome have historically attracted rapid weaponization given the browser's enormous attack surface and attacker interest.
RemediationAI
Update Google Chrome to version 152.0.7977.82 or later immediately, as documented in the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html. Chrome's auto-update mechanism will deliver this patch automatically on consumer systems; enterprise administrators managing Chrome via policy (Google Admin console or Group Policy) should verify deployment status and force update rollout if auto-update is throttled. If emergency patching is not immediately feasible, disabling JavaScript execution via enterprise policy or restricting navigation to untrusted external websites via proxy controls can reduce exposure, but both carry significant functional trade-offs - JavaScript is required by virtually all modern web applications. Site Isolation (enabled by default in Chrome) partially limits cross-origin impact but does not prevent exploitation of this class of bug.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is Google Chrome's open-source, high-performance JavaScript and WebAssembly engine, responsible for parsing, JIT-compiling, and executing JavaScript across all Chromium-based browsers. CWE-843 (Type Confusion) arises when the engine incorrectly assumes that a JavaScript object is of one internal type while it is actually another, leading to heap memory being read or written with the wrong field layout - typically enabling out-of-bounds access and eventually arbitrary code execution in the renderer process. Affected products are identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Google Chrome desktop releases prior to 152.0.7977.82. The Chromium issue tracker reference (https://issues.chromium.org/issues/542403045) may contain further technical detail on the specific V8 subsystem involved, though that tracker entry was not analyzed here.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via webpage (AV:N), straightforward exploit path (AC:L), no authentication (PR:N), single user click required (UI:R); full renderer memory access justifies C:H/I:H/A:H within the sandboxed scope (S:U).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
2DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 3
Technical POC Analysis
CWE-843: Access of Resource Using Incompatible Type ("Type Confusion") in the V8 JavaScript engine in Google Chrome / Chromium before 152.0.7977.82.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Google Chrome users across the organization face remote code execution risk when visiting attacker-controlled websites, potentially enabling data theft and credential compromise. This V8 type-confusion vulnerability allows unauthenticated attackers to execute arbitrary code within the browser by enticing users to visit specially crafted pages. While no public exploit has been identified at time of analysis, the historical pattern of rapid weaponization of similar V8 vulnerabilities makes prompt patching critical.
Apply vendor patch.
Threat Model
5 threats: Elevation of Privilege, Denial of Service, Information Disclosure and 2 more
3-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB