Description
Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-06-04
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An inappropriate implementation in the V8 JavaScript engine of Google Chrome prior to the version 149.0.7827.53 permits a remote attacker to execute arbitrary code within the Chrome sandbox by delivering a crafted HTML page. Based on the description, it is inferred that the flaw requires no user interaction beyond viewing the page and can grant the attacker the privileges of the browser’s renderer process.

Affected Systems

The vulnerability affects all users running Google Chrome versions older than 149.0.7827.53 on desktop operating systems, including Windows, macOS, and Linux. The issue resides in the browser itself, so the impact is independent of the underlying OS and extends to any environment where the affected browser version is installed.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity rating. The EPSS score is below 1%, and the flaw is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. However, because the attack vector is purely remote and only requires a malicious web page to be opened, the potential for compromise remains significant for users who have not applied the latest patch.

Generated by OpenCVE AI on June 7, 2026 at 16:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Google Chrome update (149.0.7827.53 or newer) to eliminate the V8 buffer overflow and input validation weaknesses (CWE-119, CWE-20).
  • If an immediate update is not feasible, enable Chrome’s strictest renderer sandbox profile and disable legacy JavaScript engine features, which mitigates type‑conversion flaws and code‑generation vulnerabilities (CWE-843, CWE-94).
  • Configure or enforce a Content Security Policy that restricts inline scripts and remote code execution to further reduce the risk of exploit after a crafted page is opened.

Generated by OpenCVE AI on June 7, 2026 at 16:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title V8 JavaScript Engine Remote Code Execution via Crafted HTML Page chromium-browser: Inappropriate implementation in V8
Weaknesses CWE-843
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 05 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Fri, 05 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Title V8 JavaScript Engine Remote Code Execution via Crafted HTML Page

Fri, 05 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Title Inappropriate V8 Implementation Enables Remote Code Execution in Chrome
Weaknesses CWE-125

Fri, 05 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-94
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 05 Jun 2026 03:30:00 +0000

Type Values Removed Values Added
Title Inappropriate V8 Implementation Enables Remote Code Execution in Chrome
Weaknesses CWE-119
CWE-125

Fri, 05 Jun 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 04 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-05T12:16:51.069Z

Reserved: 2026-06-04T17:06:00.599Z

Link: CVE-2026-10904

cve-icon Vulnrichment

Updated: 2026-06-05T12:16:46.183Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-04T23:16:52.183

Modified: 2026-06-05T20:15:24.103

Link: CVE-2026-10904

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-10904 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T17:00:05Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-20

    Improper Input Validation

  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')