Description
Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a type confusion flaw in the V8 JavaScript engine used by Google Chrome. When a crafted HTML page triggers the bug, the engine misinterprets data types, allowing the attacker to execute arbitrary code inside the browser's sandbox. The impact is the ability to run arbitrary code within the sandbox, which could compromise the browsing session.

Affected Systems

Google Chrome browsers running a version earlier than 155.0.8059.39 are affected. The issue exists across all platforms where Chrome ships the V8 engine, including Windows, macOS, Linux, and Android.

Risk and Exploitability

The flaw receives a CVSS score of 8.8, indicating high severity. No EPSS value is published, and the flaw is not yet listed in CISA’s KEV catalog. The likely attack vector is a remote attacker delivering a malicious HTML page that a victim opens in Chrome; the page must be processed by the V8 engine. Successful exploitation would provide the attacker with the ability to run arbitrary code inside the browser sandbox, potentially compromising the browsing session.

Generated by OpenCVE AI on October 7, 2026 at 03:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Chrome version 155.0.8059.39 or later to obtain the V8 fix.
  • Configure Chrome to automatically update to the latest stable release to avoid staying on vulnerable versions.
  • If immediate upgrade is not possible, minimize exposure by blocking untrusted web content via a web content filter or by using the Chrome security settings to disable JavaScript on untrusted domains.

Generated by OpenCVE AI on October 7, 2026 at 03:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Type Confusion in V8 Enables Remote Code Execution via Crafted HTML Page chromium-browser: Type confusion in V8
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 07 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Title Type Confusion in V8 Enables Remote Code Execution via Crafted HTML Page

Wed, 07 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-843
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-07T03:55:59.203Z

Reserved: 2026-10-06T16:33:09.859Z

Link: CVE-2026-106240

cve-icon Vulnrichment

Updated: 2026-10-06T19:41:03.737Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:17:50.913

Modified: 2026-10-07T13:53:15.467

Link: CVE-2026-106240

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-06T18:41:13Z

Links: CVE-2026-106240 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T03:15:08Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')