EUVD-2026-79958
GHSA-8h6f-xpv2-w7h5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryJavaScript triggers V8 integer overflow
-
ExploitCorrupt memory in renderer
-
ExecutionExecute arbitrary code inside sandbox
-
ImpactChain sandbox escape for host RCE
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML/JavaScript in a vulnerable Chrome build (prior to 153.0.8010.47) with JavaScript enabled (default) - i.e., visiting a malicious page or a page carrying malicious ad/injected content (UI:R). The critical LIMITING factor is that arbitrary code execution is confined to the renderer sandbox: the description claims no sandbox escape, so full host/OS compromise requires chaining a separate sandbox-escape vulnerability. No authentication is needed (PR:N). Chrome's default auto-update mitigates exposure quickly for typical consumer installs; risk concentrates on unpatched or update-delayed enterprise fleets. |
| Impact | This is a genuine high-severity memory-corruption bug in V8, but several signals argue against treating it as an emergency relative to its 9.6 CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:R) correctly captures remote, unauthenticated, low-complexity exploitation requiring only that a victim load a crafted HTML page. However, the description explicitly limits impact to 'execute arbitrary code inside the sandbox' - the renderer sandbox is NOT escaped, which means host compromise requires a separate sandbox-escape bug to chain. That containment makes the vendor's S:C (scope changed) and full C:H/I:H/A:H rating questionable; Chromium itself rated this only 'High', not 'Critical', consistent with a sandboxed-only primitive. Exploitation-status signals are all cold: EPSS is low (0.36%, 30th percentile), CISA SSVC records Exploitation:none and Automatable:no (Technical Impact:total reflects the in-sandbox code-exec, not host takeover), there is no KEV listing, and no public POC. Net: real and patch-worthy on the browser's normal rapid cadence, but currently no public exploit identified and not evidence of a widespread mass-exploitation priority - the S:C-driven 9.6 likely overstates real-world blast radius for an in-sandbox-only bug. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page (via a link, ad, or compromised site) that triggers the V8 integer overflow when the victim's Chrome renders it, achieving arbitrary code execution confined to the renderer sandbox. To reach the host OS the attacker must chain a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Integer overflow in V8, Chrome's JavaScript engine, allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Chrome builds prior to 153.0.8010.47; the bug carries a high CVSS (9.6 as published, scored 8.8 under our scope-unchanged reassessment) because memory corruption in V8 can be leveraged for code execution, though impact is confined to the renderer process and full host compromise would require chaining a separate sandbox-escape flaw. Chrome ships on a rapid auto-update cadence and a vendor patch is available (153.0.8010.47), which limits mass exposure; EPSS is a modest 0.36% (30th percentile), CISA SSVC records no observed exploitation, and no public exploit code has been identified at time of analysis, so this is a high-severity memory-safety defect to prioritize for unpatched or update-delayed enterprise fleets rather than an active-emergency. No authentication is required (PR:N), but exploitation depends on user interaction: the victim must load attacker-controlled JavaScript with scripting enabled in the default configuration.
RemediationAI
Vendor-released patch: Google Chrome 153.0.8010.47 or later - upgrade immediately, as the fix is delivered through Chrome's Stable Channel (advisory: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html). End users should confirm the version at chrome://settings/help and fully restart the browser so the update takes effect (a running instance continues to expose the vulnerable V8 build; restarting closes all tabs and may interrupt sessions). Enterprise administrators should force the update through Chrome Browser Cloud Management or their update policy such that Chrome auto-update cannot fall behind, and should inventory Chromium-based and embedded-browser endpoints whose Chromium base predates 153.0.8010.47 until those vendors rebase and ship their own fix. Where patching is delayed, compensating controls are limited: keep site isolation enabled and do not relax it (it constrains the reach of renderer code execution but does not stop the overflow itself), block untrusted or unsanctioned script/HTML at the network edge and use ad-blocking/proxy content filtering to reduce exposure to malicious ad-injected or drive-by pages (this misses same-origin and phishing-delivered payloads), and selectively disabling JavaScript for high-risk browsing severely degrades most web applications and is impractical as a general control. No vendor-released workaround substitutes for updating to 153.0.8010.47; because exploitation requires user interaction, risk is highest for users on aged or frozen builds such as unmanaged kiosks, VDI images, and environments pinning older Chrome versions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-190 integer overflow in V8, Chromium's high-performance JavaScript/WASM engine used by Chrome and other Chromium-derived browsers. Integer overflows in V8 typically arise during array/typed-array length, index, or bounds arithmetic feeding the optimizing JIT compiler, where a wrapped or truncated calculation produces an out-of-bounds heap access that can be shaped into a read/write primitive and ultimately arbitrary code execution within the renderer process. Chrome's multi-process architecture places V8 inside a restricted renderer sandbox; as described, this bug does not escape that sandbox, so the practical consequence is in-sandbox code execution against the renderer (and any accessible origin data under that process), not direct OS-level compromise - the published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) assumes scope change, whereas our reassessment scores the same metrics with S:U (8.8), reflecting the sandbox-confinement caveat. Exploitation requires the victim to render attacker-supplied HTML/JavaScript (UI:R) with JavaScript enabled, the default; no credentials are needed (PR:N). Chromium's standard hardening - site isolation, the renderer sandbox, ASLR, PartitionAlloc - raises the cost of turning the overflow into reliable control, which is consistent with the absence of any known exploit in the wild.
Know when V8 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with user interaction (UI:R), no auth (PR:N); scope set to S:U because code execution is contained within the renderer sandbox with no stated escape, yielding ~8.8 rather than 9.6.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome builds prior to 153.0.8010.47 contain a critical memory-corruption flaw in the V8 JavaScript engine that a remote attacker can trigger by getting a user to open a crafted web page, enabling arbitrary code execution inside the browser's renderer sandbox. Because the impact is confined to the renderer process - full host takeover would require chaining a separate sandbox-escape vulnerability - the practical exposure for the organization is concentrated in endpoints that are unpatched or whose auto-update is delayed or disabled, not in a confirmed active compromise. Leadership should still prioritize this because Chrome is ubiquitous across the workforce, and browser-resident code execution is a common foothold that attackers later escalate from.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Google V8 before 3.17.13, as used in Google Chrome before 27.0.1444.3, allows remote attackers to cause a denial of serv
Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allo
Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.80, allow
Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Google Chrome before 33.0.1750.146, allo
Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow
Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed object
The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not
objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API intercepto
objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy
uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which
Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allo
Multiple buffer overflows in runtime.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, all
Same weakness CWE-190 – Integer Overflow or Wraparound
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB