Description
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A race condition exists within the V8 JavaScript engine used by Google Chrome versions prior to 155.0.8059.39. The flaw permits a remote attacker to craft an HTML page that, when loaded, causes the engine to execute arbitrary code inside the browser sandbox. This leads to memory corruption and the potential for arbitrary code execution, compromising the integrity and confidentiality of the affected system.

Affected Systems

Google Chrome browsers that have not applied the 155.0.8059.39 update are vulnerable. All platforms that ship this Chrome version, including Windows, macOS, and Linux desktop releases, are impacted until the patch is installed.

Risk and Exploitability

Exploit requires a user to load a maliciously crafted web page, implying a remote attack vector. The CVSS score of 8.8 indicates high severity and no EPSS information is available. The vulnerability is not presently listed in CISA’s KEV catalog, indicating no known exploitation in the wild yet, but the nature of the flaw suggests it could be actively leveraged if discovered by attackers.

Generated by OpenCVE AI on October 7, 2026 at 01:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 155.0.8059.39 or later
  • Enable automatic updates to receive future security patches
  • If unable to update immediately, consider blocking or sandboxing untrusted sites or disabling JavaScript until the update is applied

Generated by OpenCVE AI on October 7, 2026 at 01:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 07 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome V8 Allows Remote Execution Inside Sandbox

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome V8 Allows Remote Execution Inside Sandbox

Tue, 06 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-362
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-07T03:55:55.099Z

Reserved: 2026-10-06T16:31:09.208Z

Link: CVE-2026-106201

cve-icon Vulnrichment

Updated: 2026-10-06T19:40:49.296Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-06T19:17:46.370

Modified: 2026-10-07T04:17:50.080

Link: CVE-2026-106201

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T04:15:11Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')