EUVD-2026-89380
GHSA-2r8w-3fqq-9r8v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitMalicious JS triggers V8 type confusion
-
ExecutionCorrupt object type interpretation
-
ImpactExecute arbitrary code within V8 sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires user interaction (UI:R): the victim must load an attacker-controlled or compromised HTML page in a vulnerable Chrome build prior to 154.0.8037.92. No authentication or privileges are needed (PR:N), and no special browser configuration is required - default Chrome with JavaScript enabled (the default) is sufficient. The principal limiting factor is that the victim must actively browse to the malicious page, and code execution is confined to the V8 sandbox, so meaningful host-level compromise requires chaining a separate sandbox-escape vulnerability. |
| Impact | This is a genuine high-priority browser vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a low-complexity, network-reachable, unauthenticated attack requiring only that a victim visit a crafted HTML page - the classic drive-by profile for browser bugs. CWE-843 type confusion in V8 is one of the most reliably weaponizable Chrome bug classes and Google rated it 'High' severity. Countervailing signals temper the raw score: the description explicitly scopes code execution to 'inside the sandbox,' meaning this alone yields V8-heap-level execution rather than a full host compromise (a sandbox escape would need to be chained), so S:U is correct and the practical impact is narrower than 8.8 suggests. No EPSS score, no CISA KEV listing, and no public POC are provided in the input, so there is no evidence of active exploitation - this is not confirmed in-the-wild yet. Given Chrome's ubiquity and V8 type-confusion's strong historical exploitation track record, patching should still be treated as urgent even absent current exploitation data. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted JavaScript that triggers a type-confusion condition in Chrome's V8 engine. A victim running a pre-154.0.8037.92 Chrome browser visits the page and the engine misinterprets an object's type, giving the attacker arbitrary code execution within the V8/renderer sandbox. No public exploit code is identified in the provided data; full host compromise would require chaining an additional sandbox-escape bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Type confusion in Chrome's V8 JavaScript engine lets a remote attacker execute arbitrary code inside the V8 sandbox when a victim loads a crafted HTML page in any Chrome build prior to 154.0.8037.92. Exploitation requires user interaction (the victim must browse to the malicious or compromised page) but no authentication or special configuration, since default JavaScript execution is sufficient; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Google has released a vendor patch in 154.0.8037.92, and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) has been identified. Because the flaw is contained by the V8 sandbox, full host compromise would require chaining a separate sandbox-escape vulnerability.
RemediationAI
Upgrade Google Chrome to 154.0.8037.92 or later - this is the vendor-released patch and the only complete fix; the update is delivered through Chrome's built-in updater (chrome://settings/help) and can be forced in managed fleets via Google Update/Chrome Browser Cloud Management policies. Confirm the installed version after updating, then restart all running browser instances, since an updated binary does not replace an already-running vulnerable process. Where immediate updating is impossible, temporary compensating controls include restricting browsing to trusted sites via URL allow/block lists and enterprise policy, or disabling JavaScript by default (chrome://settings/content/javascript, or the DefaultJavaScriptSetting policy) - the trade-off is severe breakage of most modern web applications. Enabling Enhanced Safe Browsing and keeping site isolation enforced reduces the chance of landing on exploit-hosting pages but are detective/preventive aids, not substitutes for patching. Because the type confusion only achieves execution within the V8 sandbox, a fully patched host is also protected against follow-on sandbox-escape chains; consult the advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html for the authoritative fix release. No vendor-released patch was withheld: patch status is available per vendor, with 154.0.8037.92 as the fixed version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-843 type confusion in V8, Chrome's JavaScript and WebAssembly engine. Type confusion arises when the engine's optimizing compiler (TurboFan/Maglev) or its object model infers one object layout and then operates on memory holding a different, incompatible type - typically after incorrect map (hidden class) or feedback-vector assumptions. This yields out-of-bounds reads/writes and memory corruption inside the renderer process (the intelligence tags classify it as RCE and memory corruption). Critically, V8 in modern Chrome runs inside the V8 heap sandbox, a memory-isolation layer that confines corrupted pointers to a reserved address space; the described code execution is therefore 'inside the sandbox' and does not by itself give host-level code execution. The CVE maps to CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the affected version constraint being versions earlier than 154.0.8037.92 (EUVD records Chrome 154.0.8037.92 <154.0.8037.92), and the reference Chromium issue 559266114 tracks the internal fix. Exploitation follows the standard browser threat model: the attacker hosts a crafted HTML page, the victim navigates to it with JavaScript enabled, and the type confusion is triggered in the renderer.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs only a victim visit (AV:N/AC:L/PR:N/UI:R); type confusion yields full sandboxed RCE (C/I/A:H) without crossing the sandbox boundary, so S:U.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 154.0.8037.92 are affected by a high-severity type confusion vulnerability in the V8 JavaScript engine that could allow a remote, unauthenticated attacker to execute arbitrary code within the browser sandbox if a user visits a crafted webpage; no public exploit identified at time of analysis. Because Chrome is widely deployed across the organization, unpatched browsers represent a potential vector for data compromise or further intrusion if the flaw is chained with a sandbox escape, making immediate patching a priority for security leadership.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB