Description
Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Now
AI Analysis

Impact

The revised CVE description continues to highlight a type‑confusion flaw in the V8 JavaScript engine that allows a remote attacker to craft a malicious HTML page. When viewed in Google Chrome prior to 156.0.8078.47, this memory corruption can cause execution of arbitrary code inside the sandbox. This bypasses normal browser isolation and grants code‑execution privileges at the user level. The vulnerability is classified as CWE-843.

Affected Systems

Google Chrome users running versions earlier than 156.0.8078.47 are impacted. The flaw exists in the stable channel of Chrome, affecting all desktop platforms that include the V8 engine in the affected build.

Risk and Exploitability

The CVSS score of 8.8 points indicates a high severity level. The EPSS score of less than 1 % shows a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread attacks. The likely attack vector is remote via a crafted HTML page; a victim must visit or open a malicious webpage. This type‑confusion bug (CWE‑843) allows the attacker to escape the browser sandbox and execute arbitrary code, potentially leading to full system compromise if additional vulnerabilities are present.

Generated by OpenCVE AI on November 4, 2026 at 13:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 156.0.8078.47 or later
  • Enable Chrome’s automatic update feature or schedule regular update checks to apply future security patches promptly
  • If an upgrade cannot be performed immediately, use Chrome’s safe browsing feature to block untrusted content and avoid visiting suspicious websites until the patch is installed

Generated by OpenCVE AI on November 4, 2026 at 13:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 13:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Memory Corruption in V8 Engine

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-843

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Memory Corruption in V8 Engine

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Thu, 22 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-119
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:28.168Z

Reserved: 2026-10-19T23:07:28.791Z

Link: CVE-2026-113192

cve-icon Vulnrichment

Updated: 2026-10-20T23:26:47.927Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:12.100

Modified: 2026-11-03T22:18:48.273

Link: CVE-2026-113192

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T13:15:14Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')