EUVD-2026-82483
GHSA-7w5f-8qxv-hch4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious JavaScript triggers V8 type confusion
-
ExploitCorrupt object type interpretation
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactChain sandbox escape for host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires user interaction: the victim must be socially engineered into loading a crafted HTML page in a vulnerable Chrome build (prior to 153.0.8010.52) - this is UI:R, not a fully automatic remote exploit. No authentication or special configuration is needed and default Chrome configurations are affected, but the resulting code execution is confined to the renderer sandbox; achieving host-level compromise requires chaining an additional sandbox-escape vulnerability, which limits the standalone impact. |
| Impact | This is a genuine high-priority patch-now issue for a ubiquitous product, though with an important nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) describes a remote, low-complexity, unauthenticated drive-by requiring only that a victim visit a crafted page - the classic browser threat model. V8 type-confusion bugs (CWE-843) are historically among the most exploited Chrome bug classes and frequently reach reliable RCE. However, the description and the S:U (scope unchanged) metric are explicit that code executes INSIDE the renderer sandbox, not on the host: full compromise requires chaining a separate sandbox-escape bug, which materially reduces standalone real-world impact versus a scope-changed escape. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so at time of analysis there is no evidence of active exploitation or weaponized code - the priority rests on the product's ubiquity and the exploitability of the bug class, not on confirmed in-the-wild use. No signals conflict: network vector, unauthenticated, and UI:R (social engineering) are mutually consistent. Sibling bugs patched in the same 153.0.8010.52 release include full sandbox escapes (CVE-2026-93373, CVE-2026-93375), so applying the update addresses this bug alongside more severe ones. |
| Exploit ScenarioDerived | An attacker lures a victim to a malicious or compromised web page (or a malicious ad) whose crafted HTML/JavaScript triggers the V8 type-confusion flaw. Successful exploitation yields arbitrary code execution within the Chrome renderer sandbox; to escape onto the host the attacker would typically chain a second sandbox-escape vulnerability. No public exploit code is identified in the provided data at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Type confusion in the V8 JavaScript engine of Google Chrome prior to 153.0.8010.52 allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim is socially engineered into loading a crafted HTML page (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not automatic: it requires user interaction, and because the resulting code execution is confined to the renderer sandbox, turning it into host-level compromise would require chaining a separate sandbox-escape vulnerability. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch (Chrome 153.0.8010.52) is available and this is a patch-now item for a ubiquitous product.
RemediationAI
Apply the vendor-released patch by upgrading Google Chrome to 153.0.8010.52 or later - allow the built-in updater to run, or use Help > About Google Chrome to force the update, then fully restart the browser so the new binary is loaded; enterprise fleets should push the fixed build via their management tooling and verify the reported version rather than relying on auto-update alone, and downstream Chromium-based browsers should be updated as soon as their maintainers ship the matching V8 fix. Details are in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html and the upstream bug at https://issues.chromium.org/issues/560121552. Where immediate patching is impossible, the most direct compensating control is to reduce exposure to untrusted JavaScript - restrict browsing to allowlisted sites and disable or block untrusted web content at the network/proxy layer - accepting the productivity cost; keeping the renderer sandbox and Site Isolation enabled (both default) is essential because it contains this bug to the renderer and prevents a standalone host compromise, and disabling V8 JIT (for example via a --js-flags="--jitless" launch flag) removes this class of JIT type-confusion bug at a significant JavaScript performance cost, making it viable only as a short-term emergency measure. There is no evidence of in-the-wild exploitation, so these workarounds should be treated as temporary until 153.0.8010.52 is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a type confusion (CWE-843) in V8, Chrome's JavaScript/Wasm engine. Type confusion in a JIT-compiling engine typically arises when optimized code makes assumptions about an object's hidden class/map or inferred type that no longer hold at runtime, so a value of one type is operated on as if it were another - producing out-of-bounds reads/writes and, in practice, a memory-corruption primitive that can be shaped into arbitrary code execution inside the renderer process. The attack surface is JavaScript delivered through a crafted HTML page, meaning the trigger is client-side and content-driven rather than a network service exposure. The affected technology stack is Google Chrome's desktop stable channel on Windows, macOS and Linux; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms the attacker needs no credentials or special configuration, but does require a victim to open the malicious page. Chromium assigns this a security severity of High; EUVD tracks it as EUVD-2026-82483 and the upstream issue is tracked privately at issues.chromium.org/560121552.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page drive-by with no auth (AV:N/AC:L/PR:N) but victim must open the page (UI:R); code exec stays in-sandbox so S:U with full C/I/A within that renderer boundary.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A type-confusion flaw in Google Chrome's V8 JavaScript engine (CVE-2026-93377) lets an attacker execute arbitrary code on any endpoint where a user is lured into opening a malicious web page, putting essentially every Chrome-using employee and their device in scope. The code runs inside Chrome's renderer sandbox rather than the host operating system, so this alone does not hand an attacker full control of the machine, but it removes a critical layer of protection and would become a host-level compromise if paired with a separate browser escape flaw. Because Chrome is deployed universally across the organization, leadership should treat this as a routine but time-sensitive update that is fully resolvable by applying the vendor's fixed release.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB