EUVD-2026-79983
GHSA-88x4-r5w3-45vm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage loads malicious ServiceWorker script
-
ExploitTrigger type confusion (CWE-843)
-
ExecutionCorrupt memory in renderer
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load attacker-controlled content in a vulnerable Chrome build (<153.0.8010.47) - the UI:R requirement means a user must visit or be redirected to a crafted HTML page; there is no zero-click path. No authentication or special privileges are needed (PR:N), and default Chrome configurations are affected since ServiceWorker is a standard web-platform feature enabled out of the box. The key limiting factor is that code execution is confined to the renderer sandbox (S:U): achieving host compromise requires chaining an additional sandbox-escape vulnerability, and users who have already applied the 153.0.8010.47+ update or use auto-update are not exposed. |
| Impact | This is a genuine patch-priority issue for any organization running Google Chrome, though the raw CVSS 8.8 slightly overstates standalone impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated bug requiring only that a victim visit a malicious page - the classic drive-by browser exposure. The critical nuance is that the description explicitly limits code execution to 'inside the sandbox' (S:U, no scope change), meaning this alone yields renderer-process compromise, not full host takeover; weaponizing it for OS-level control typically requires chaining a separate sandbox-escape bug. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is currently no confirmed active exploitation or public exploit code. Countervailing signals raise urgency: it is a memory-corruption/type-confusion flaw (CWE-843, historically the most reliably weaponized Chrome bug class), Google rated it Chromium-High, a patch is already shipping, and Chrome is ubiquitous - a combination that historically attracts n-day exploitation shortly after disclosure. Net: prioritize patching, but note that the absence of KEV/EPSS/POC means exploitation is presently unproven rather than confirmed. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the ServiceWorker type-confusion condition, then lures a victim to visit it (malvertising, phishing link, or watering-hole). When the victim's vulnerable Chrome loads the page, the attacker gains arbitrary code execution within the renderer sandbox, positioning for a follow-on sandbox escape to reach the host. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Type confusion in Chrome's ServiceWorker implementation allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by enticing a victim to load a crafted HTML page in any Chrome build prior to 153.0.8010.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must visit or be redirected to attacker-controlled content - and the resulting code execution is confined to the sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. There is no public exploit identified at time of analysis, and a vendor-released patch (153.0.8010.47) is available, making this a high-priority but practically bounded patching task rather than an urgent zero-day response.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 153.0.8010.47 or later, as documented in the Stable Channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html; because Chrome's updater typically stages the binary in the background, verify the reported version via chrome://version and fully restart the browser (and any long-lived Chromium-based processes) so the patched renderer is actually in use. Organizations that manage Chrome through enterprise policy should force an update check and confirm the fleet-wide minimum version, since the vulnerability is remotely reachable from ordinary web content and default configurations are exposed. If patch deployment cannot be completed immediately, the practical mitigations are exposure-reduction rather than true fixes: keep Site Isolation enabled (it limits cross-origin data theft but does not prevent renderer RCE), restrict browsing to trusted sites through URLBlocklist/URLAllowlist policies or a proxy with category filtering - at the cost of breaking general web access - and, where feasible, route high-risk browsing through a separate, fully updated browser profile or virtualized/isolated environment, accepting the added operational friction. There is no documented Chrome policy that disables ServiceWorker outright, so any 'disable the feature' approach would require unsupported flags and should not be relied on; because this bug only yields renderer-sandbox code execution, tightening sandbox-escape defenses and prioritizing the update remain the highest-value actions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-843 type confusion in the ServiceWorker subsystem, a standard web-platform feature that lets sites register background scripts to intercept network requests, manage caches, and handle push/offline events. Type confusion occurs when code treats an object as a different, incompatible type than it actually is, typically leading to out-of-bounds or mismatched memory access - the tag applied to this CVE ('Memory Corruption', 'RCE') is consistent with that class of bug in a browser component where a confused object can be used to corrupt memory and redirect execution. Because ServiceWorker is enabled out of the box and reachable from ordinary web content, no special privileges or authentication are needed; the attacker only has to get the victim's browser to render a malicious page. Google rates the issue as Chromium security severity High, and it is tracked publicly as Chromium issue 558367547 with the associated Stable Channel update advisory. No CPE strings were supplied in the source data, but the affected component is the Chrome/Chromium browser binary itself, with the vendor advisory identifying builds below 153.0.8010.47 as vulnerable.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page (AV:N/AC:L/PR:N), victim must visit it (UI:R), execution stays within the renderer sandbox (S:U) with high renderer-context C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 153.0.8010.47 are affected by a high-severity flaw that can allow code execution within the browser's isolated environment when a user visits malicious web content. The business risk is bounded because the code remains isolated, exploitation requires user interaction, and no public exploit identified at time of analysis, but unpatched browsers across the workforce create avoidable exposure. Leadership should treat this as a high-priority patch management task, not an emergency incident response, and ensure rapid version enforcement.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB