Description

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-03T20:17:24.210Z",
  "pubdate": "2026-09-03T20:17:24.210Z",
  "executiveSummary": "A type confusion vulnerability exists in the V8 JavaScript engine utilized by Google Chrome, specifically affecting versions prior to 152.0.7977.82.\nThe vulnerability occurs due to a failure in the V8 engine's type-checking mechanism, allowing an attacker to manipulate internal object representations.\nSuccessful exploitation enables a remote attacker to achieve arbitrary code execution within the security context of the browser sandbox.\nThis vulnerability is classified as High severity because it can be weaponized via a crafted HTML page, requiring only that a user navigate to malicious content.\nThe primary risk involves bypassing browser security boundaries, which could lead to further exploitation, system compromise, or data exfiltration if combined with sandbox escape techniques.\nExploitation does not require authentication or elevated system privileges, relying solely on the victim's interaction with the malicious web content.",
  "technicalDetails": "The vulnerability resides within the V8 engine, which is the JavaScript and WebAssembly engine used by Chromium-based browsers. Type confusion occurs when the engine incorrectly identifies the type of an object during runtime, leading to operations being performed on data that do not correspond to the object's intended memory layout.\nIn V8, the Just-In-Time (JIT) compiler utilizes hidden classes (or 'shapes') to optimize object property access. When the compiler makes an incorrect assumption about the type of an object due to flawed type inference or optimization passes, it may generate machine code that treats a pointer as a different data type. This discrepancy can be exploited to facilitate out-of-bounds memory read/write operations.\nThe exploitation flow typically begins when a remote attacker hosts a specially crafted HTML page. Upon visiting this page, the browser's V8 engine executes malicious JavaScript designed to trigger the type confusion state. By carefully arranging the heap and inducing specific JIT optimizations, the attacker forces the engine to misinterpret an object reference.\nOnce the type confusion is established, the attacker can use the resulting primitive to read or write memory outside the intended memory bounds of the object. This is often leveraged to corrupt object pointers, such as those within an ArrayBuffer or a JavaScript object, allowing the attacker to craft a 'fake' object with arbitrary properties.\nBy achieving arbitrary memory read and write primitives, an attacker can overwrite critical function pointers or exploit JIT-compiled code caches to redirect the instruction pointer to an attacker-controlled payload. Although the exploit executes within the browser's sandbox, it effectively bypasses the memory safety mechanisms enforced by V8.\nAffected versions include all Google Chrome releases prior to 152.0.7977.82. The attack is network-exposed, as it is triggered through web browsing. There are no authentication requirements for an attacker to initiate this chain; the sole vector is the processing of maliciously crafted JavaScript instructions by the victim's browser."
}