Description

Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T20:17:23.890Z",
  "pubdate": "2026-09-03T20:17:23.890Z",
  "executiveSummary": "A critical race condition vulnerability exists within the V8 JavaScript engine utilized by Google Chrome.\nThis flaw permits a remote attacker to achieve arbitrary code execution within the browser's security sandbox environment.\nThe vulnerability affects versions of Google Chrome prior to 152.0.7977.82.\nThe exploitation of this race condition requires a user to interact with a maliciously crafted HTML page, which triggers the race condition during the execution of JavaScript code.\nSuccessful exploitation facilitates unauthorized code execution, posing a significant risk to user data confidentiality, integrity, and system availability.\nThe impact is classified as High severity, as it bypasses standard browser security boundaries despite operating within the constraints of the renderer sandbox.\nNo specific authentication is required, as the attack vector is delivery via a standard web page, making it a high-risk threat for users navigating to untrusted domains.",
  "technicalDetails": "The vulnerability stems from a race condition within the V8 JavaScript engine, the high-performance component of the Chromium browser responsible for compiling and executing JavaScript code.\nRace conditions in V8 typically manifest during the concurrent execution of JIT (Just-In-Time) optimization phases or during asynchronous memory management operations involving the garbage collector or heap management sub-systems.\nIn this specific instance, the race condition allows for memory corruption or an inconsistent state to be introduced during the concurrent handling of objects or memory references in the V8 heap.\nThe exploitation flow initiates when a victim visits a malicious HTML page containing specifically engineered JavaScript code designed to manipulate V8 object layouts or trigger asynchronous execution paths that are not thread-safe.\nBy inducing a timing discrepancy between different internal engine threads, an attacker can coerce the engine into performing operations on freed or improperly initialized memory, a state often leveraged to achieve type confusion or a use-after-free scenario.\nOnce the initial memory corruption is achieved, the attacker can manipulate internal V8 data structures, such as ArrayBuffers or JSObjects, to gain a primitive for arbitrary read/write access to the renderer process memory space.\nGiven that V8 acts as the execution engine for JavaScript, this memory manipulation allows the attacker to hijack the control flow of the renderer process, facilitating the execution of arbitrary shellcode or malicious scripts.\nAlthough this occurs within the restricted Chromium sandbox, the ability to execute arbitrary code provides a foundation for further sandbox escape attempts or data exfiltration.\nThe vulnerability persists across affected versions prior to 152.0.7977.82, requiring no prior authentication from the victim other than the navigation to the attacker-controlled resource.\nThe root cause suggests a deficiency in the synchronization primitives or locking mechanisms intended to guard shared state during complex JIT compilation or memory management tasks within the engine's internal architecture.\nPost-exploitation, the attacker gains the execution context of the renderer process, allowing for the potential capture of sensitive user information, such as cookies, local storage, and cached data, which are accessible within that specific origin's scope."
}