Description

Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:00.247Z",
  "pubdate": "2026-08-25T21:18:00.247Z",
  "executiveSummary": "A type confusion vulnerability exists within the V8 JavaScript engine utilized by Google Chrome, specifically impacting versions prior to 152.0.7977.65. The flaw resides in the JIT (Just-In-Time) compilation or object handling logic, allowing an attacker to manipulate internal object representations.\nThe primary impact of this vulnerability is unauthorized memory disclosure. By successfully exploiting this flaw, a remote attacker can read sensitive information residing within the browser's sandbox environment. The exploitation process requires social engineering to direct a user to a crafted HTML page, which then triggers the vulnerability through malicious JavaScript execution.\nAlthough the vulnerability is classified as Low severity by Chromium, it poses a risk to data confidentiality. The inability of the sandbox to enforce strict memory access controls when this type confusion occurs allows the attacker to bypass memory isolation constraints. The exploitation does not require administrative privileges or prior authentication, relying instead on browser-based execution. Users are advised to update their browsers immediately to address the underlying logic error.",
  "technicalDetails": "The root cause of this vulnerability is a type confusion flaw within the V8 engine, which occurs when the engine incorrectly identifies the type of an object during runtime. V8 utilizes specialized optimization techniques, such as hidden classes and JIT compilation, to improve JavaScript execution performance. If the JIT-compiled code fails to properly validate the object type before accessing its underlying memory structure, an attacker can influence the engine to perform operations on a memory block using an incompatible data structure.\nIn this specific instance, the V8 engine exhibits an inconsistency in handling object maps or properties. An attacker constructs a malicious payload designed to induce a state where the engine misinterprets a memory address or object reference. By leveraging JavaScript APIs, the attacker can influence the garbage collector or the object heap layout to place controlled data in a predictable location. When the type confusion is triggered, the engine treats this controlled data as an object of a different type, such as an array buffer or a pointer.\nThe exploitation flow begins with the delivery of a crafted HTML page containing obfuscated JavaScript. When the victim navigates to this page, the script executes, interacting with the V8 engine to trigger the specific JIT optimization path that contains the validation flaw. Once the confusion is achieved, the attacker can leverage the misclassified object to read out-of-bounds memory. This occurs because the engine allows the attacker to specify an index or offset that exceeds the expected boundaries of the memory buffer, essentially treating an arbitrary address as a navigable index.\nThe impact of this disclosure allows the attacker to leak pointers, sensitive variables, or heap contents from within the sandboxed renderer process. While the vulnerability does not directly provide remote code execution, the disclosure of memory addresses (e.g., base addresses or object references) often serves as a critical primitive for bypassing Address Space Layout Randomization (ASLR) in secondary, chained exploitation attempts. The vulnerability persists until the engine re-validates the object type or patches are applied to the optimization logic that governs how JIT-compiled code interacts with memory buffers."
}