Description

Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-06T22:16:58.573Z",
  "pubdate": "2026-08-06T22:16:58.573Z",
  "executiveSummary": "An out-of-bounds write vulnerability exists within the V8 engine in Google Chrome prior to version 151.0.7922.109, classified with a Chromium security severity of High. This memory corruption flaw allows a remote attacker to achieve arbitrary code execution inside the security sandbox via a maliciously crafted HTML page. The vulnerability presents significant risk to client systems, as successful exploitation requires no prior authentication or privileged access, relying solely on user interaction by visiting a compromised or attacker-controlled web page. The attacker capabilities include executing arbitrary code within the constraints of the browser sandbox, potentially leading to further exploitation chains if combined with sandbox escape vulnerabilities. Remediation requires updating the affected browser instances to the patched version provided by the vendor.",
  "technicalDetails": "The vulnerability is an out-of-bounds write memory safety issue localized within the V8 JavaScript and WebAssembly engine of Google Chrome. The root cause stems from improper bounds checking or memory management logic during the processing of specific JavaScript constructs or object property operations within the engine. When a remote attacker supplies a crafted HTML page containing malicious JavaScript, the V8 engine fails to properly validate index boundaries or memory allocations when interacting with internal data structures.\nExploitation occurs when the victim renders the crafted HTML page within a vulnerable instance of Google Chrome prior to version 151.0.7922.109. As the JavaScript engine compiles and executes the malicious code, the lack of adequate boundary validation triggers an out-of-bounds write condition. This permits the overwriting of adjacent memory regions within the heap space allocated to the V8 engine. By carefully manipulating the memory layout through heap grooming techniques, the attacker can corrupt critical object pointers, function tables, or type descriptors.\nThe attack flow proceeds as follows: First, the user navigates to the malicious web page hosting the exploit payload. Second, the browser parses the HTML and initiates execution of the embedded JavaScript via the V8 engine. Third, the crafted script triggers the vulnerable code path, resulting in an out-of-bounds write operation that corrupts V8 heap memory. Fourth, the memory corruption is leveraged to achieve arbitrary read/write primitives within the V8 process space. Finally, the attacker exploits these primitives to execute arbitrary code inside the browser sandbox.\nThe vulnerable component is the V8 engine. Network exposure is remote via web-based vectors, requiring the victim to load a crafted HTML page. Authentication and privilege requirements are none from the perspective of the attacker, though user interaction in the form of visiting a webpage is required. The post-exploitation impact is limited to arbitrary code execution strictly contained within the security boundaries of the browser sandbox, unless an additional vulnerability is chained to achieve a sandbox escape."
}