Description

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T00:18:22.803Z",
  "pubdate": "2026-08-28T00:18:22.803Z",
  "executiveSummary": "A critical out-of-bounds read vulnerability exists within the V8 JavaScript engine utilized by Google Chrome. This memory safety flaw allows a remote attacker to achieve arbitrary code execution within the browser's sandbox environment.\nThe vulnerability affects versions of Google Chrome prior to 151.0.7922.72. The issue stems from improper bounds checking within V8, which can be triggered by a maliciously crafted HTML page.\nSuccessful exploitation allows an attacker to bypass existing security controls to execute unauthorized code. While the execution is contained within the sandbox, such vulnerabilities are often chained with additional flaws to escape the sandbox and achieve full system compromise.\nThe risk is classified as Medium by Chromium security standards, reflecting the necessity of user interaction via web navigation to trigger the payload.\nNo specific authentication is required, as the vulnerability is exploitable via standard web interaction. Organizations should prioritize updating all instances of Google Chrome to version 151.0.7922.72 or later to eliminate the risk of remote exploitation.",
  "technicalDetails": "The vulnerability resides within the V8 engine, the high-performance JavaScript and WebAssembly engine used by Chromium-based browsers. The root cause is an out-of-bounds read, a type of memory access violation occurring when a program reads data beyond the intended buffer boundary.\nIn V8, such vulnerabilities often manifest during the Just-In-Time (JIT) compilation process. Specifically, if the compiler fails to generate correct bounds checks for array access operations or TypedArray manipulations, it may permit the engine to read memory contents outside the allocated object heap. By manipulating the JavaScript environment, an attacker can create an object layout that facilitates the out-of-bounds access, effectively reading sensitive information or corrupting internal data structures.\nThe attack flow begins when a user navigates to a malicious HTML page controlled by the attacker. This page contains JavaScript specifically designed to trigger the out-of-bounds read condition. The exploit typically leverages JavaScript object property access or array indices to force the V8 engine to perform an out-of-bounds read on its internal heap. By carefully structuring the heap, an attacker can gain primitive read/write access to adjacent memory regions.\nThis memory corruption primitive is the foundation for further exploitation. Once an attacker has gained a read/write primitive, they may target internal pointers, such as function pointers or object maps, to redirect control flow. In the context of V8, this often involves corrupting a JIT-compiled function or a WASM instance to point to attacker-controlled shellcode or a Return-Oriented Programming (ROP) chain.\nBecause the execution occurs within the V8 sandbox, the attacker is constrained by Chromium's security architecture. However, code execution within the renderer process allows an attacker to interact with the browser's exposed APIs, potentially leading to data theft, cross-site scripting (XSS) bypasses, or further exploitation of the underlying operating system kernel or browser process IPC interfaces. The vulnerability does not require any specialized user privileges, as it is triggered simply by the parsing and execution of JavaScript in the victim's browser session."
}