Description

Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:17.853Z",
  "pubdate": "2026-08-25T21:18:17.853Z",
  "executiveSummary": "A critical type confusion vulnerability has been identified within the V8 JavaScript engine utilized by Google Chrome.\nThis security flaw, classified with a High severity rating, allows a remote attacker to achieve arbitrary code execution within the browser's sandbox environment.\nThe vulnerability resides in the way V8 handles object types during JIT compilation or optimization phases, potentially leading to unauthorized memory access.\nSuccessful exploitation requires a victim to visit a maliciously crafted HTML page, bypassing standard security controls to execute attacker-controlled code.\nThe scope of impact includes potential data theft, browser crashes, or the potential for further sandbox escape attempts, depending on the capabilities of the exploit payload.\nAffected versions include all Google Chrome releases prior to 152.0.7977.65.\nUsers and administrators are advised to prioritize updating to the specified patched version to mitigate the risk of compromise.",
  "technicalDetails": "The vulnerability is rooted in a type confusion flaw within the V8 JavaScript engine's handling of object type internal representations during the JIT (Just-In-Time) compilation pipeline, specifically within the TurboFan or Maglev optimization phases. Type confusion occurs when the engine incorrectly assumes the type of an object, leading to a mismatch between the expected object layout and the actual data stored in memory.\nIn the context of V8, this typically involves an object whose map (hidden class) is modified or replaced without the JIT-optimized machine code being properly invalidated or deoptimized. When the optimized code executes, it performs operations—such as property access or array indexing—using an incorrect type assumption. This can lead to out-of-bounds read or write primitives, or the treatment of a data pointer as a control flow or object reference.\nThe attack flow begins when an attacker directs a user to a crafted HTML page containing JavaScript designed to trigger the specific state-transition or optimization edge case that induces the type confusion. By manipulating the heap layout and carefully controlling object structures, the attacker can force the engine to operate on an object of the wrong type.\nOnce the type confusion is triggered, the attacker gains a primitive that allows for memory corruption. By achieving a controlled write-what-where primitive, an attacker can overwrite internal pointers or function pointers within the V8 heap. This allows for the redirection of execution flow, eventually leading to arbitrary code execution within the confines of the renderer process sandbox.\nBecause the execution occurs within the sandbox, the attacker is limited by the browser's security boundaries. However, achieving code execution within the renderer process is a critical precursor to further exploitation, such as chaining this vulnerability with sandbox escape exploits to gain persistent access to the underlying operating system. The vulnerability does not require authentication and is reachable remotely over the network via standard web browsing activity, making it a highly attractive target for exploitation."
}