Description

Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:18:28.407Z",
  "pubdate": "2026-08-18T21:18:28.407Z",
  "executiveSummary": "An incorrect calculation vulnerability exists within the V8 JavaScript engine of Google Chrome prior to version 151.0.7922.169.\nThis vulnerability allows a remote attacker to achieve arbitrary code execution inside the sandbox security boundary by leveraging a crafted HTML page.\nThe flaw carries a Chromium security severity rating of High, indicating significant risk to client-side integrity and user confidentiality.\nThe attacker capabilities include remote execution of arbitrary code within the restricted context of the renderer sandbox upon successful exploitation.\nExploitation requirements include user interaction, specifically requiring the victim to navigate to a malicious web page hosting the crafted HTML payload designed to trigger the V8 calculation error.\nRisk implications involve potential sandbox escalation vectors, memory corruption, and complete compromise of the rendering process, which can lead to further malicious activity if chained with additional vulnerabilities.",
  "technicalDetails": "The root cause of the vulnerability stems from an incorrect calculation flaw within the V8 JavaScript engine component of Google Chrome.\nThe vulnerable component is the V8 engine, specifically handling complex mathematical operations or memory offset calculations during script execution.\nAffected versions include Google Chrome installations prior to 151.0.7922.169.\nNetwork exposure is remote, as the attack vector requires the delivery of a crafted HTML page containing malicious JavaScript or bytecode designed to trigger the calculation error in V8.\nAuthentication requirements and privilege requirements are none from the perspective of the remote attacker; the attack relies entirely on the victim loading the malicious resource via the browser.\nThe step-by-step attack flow begins when a remote attacker hosts a crafted HTML page containing malicious JavaScript code engineered to exploit the V8 calculation flaw.\nThe victim navigates to the malicious URL using an unpatched instance of Google Chrome.\nAs the browser parses and executes the embedded script, the V8 engine encounters the flawed calculation routine, leading to memory corruption, integer overflow, or out-of-bounds access within the heap.\nThe payload behavior leverages this state corruption to manipulate internal V8 structures, allowing the execution of arbitrary code.\nThe post-exploitation impact is restricted by default to the renderer sandbox environment, achieving arbitrary code execution inside the sandbox boundary."
}