Description

Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:18:27.833Z",
  "pubdate": "2026-08-18T21:18:27.833Z",
  "executiveSummary": "A type confusion vulnerability exists in the V8 JavaScript and WebAssembly engine utilized by Google Chrome prior to version 151.0.7922.169. This memory safety flaw allows a remote attacker to achieve arbitrary code execution inside the browser sandbox mechanism through the processing of a maliciously crafted HTML page. The vulnerability presents a high risk to users as successful exploitation can lead to system compromise within the context of the renderer process. The attacker capability requires luring a victim to navigate to a specifically designed web page containing malicious content that triggers the type confusion condition during JavaScript execution. No prior authentication or elevated privileges are required from the attacker perspective, and network exposure is inherent to web browsing vectors. Exploitation relies on memory corruption primitives derived from the type confusion state, which bypasses standard browser isolation controls to execute arbitrary payloads within the sandboxed environment.",
  "technicalDetails": "The vulnerability is rooted in the V8 engine, specifically within its Just-In-Time (JIT) compiler and type inference mechanisms, which fail to properly validate or enforce object types during execution. Type confusion vulnerabilities occur when the program accesses a resource using a type that is incompatible with the type that was allocated, leading to incorrect memory offsets, type mismatches, and ultimately memory corruption. In this specific scenario, a crafted HTML page containing malicious JavaScript exploits the V8 optimization pipeline where internal type representations diverge from actual runtime object structures. The attack flow begins when a victim accesses the remote attacker-controlled web page using an affected version of Google Chrome prior to 151.0.7922.169. As the browser parses and executes the embedded script, the V8 engine makes incorrect assumptions regarding object shapes or hidden classes, often during optimized code execution phases such as Tier-up or speculative optimization. This incorrect type inference allows the attacker to manipulate arbitrary memory read and write primitives by treating an object of one type as if it were an instance of an entirely different type. By crafting malicious object layouts and exploiting the resulting confusion, the attacker can overwrite critical data structures, function pointers, or internal V8 metadata. This controlled memory corruption facilitates the execution of shellcode or arbitrary native instructions. Because the vulnerability resides in the renderer process, the execution of arbitrary code is initially contained within the security boundaries of the sandbox. However, successful exploitation within the sandbox provides a critical foothold that can be chained with a secondary sandbox escape vulnerability to achieve full system compromise or arbitrary code execution on the underlying host operating system."
}