Description
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-11-03
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A type confusion flaw in V8, the JavaScript engine used by Google Chrome, allows an attacker to run arbitrary code within the browser’s sandbox. The vulnerability is triggered by a specially crafted HTML page and is assessed as high severity by Chromium security reviewers.

Affected Systems

The flaw affects Google Chrome for desktop versions that are older than 157.0.8103.38; no specific patch level is available for later releases. All users running a vulnerable Chrome version that can render arbitrary web content are at risk.

Risk and Exploitability

The attack vector is inferred to be a remote, client‑side exploit where the user is tricked into loading a malicious page. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the severity assessment is high and a proof‑of‑concept exists, indicating a non‑negligible risk for any user who visits untrusted websites.

Generated by OpenCVE AI on November 3, 2026 at 22:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 157.0.8103.38 or later, ensuring the security patch has been applied.
  • Restart the browser after the update to clear cached engine data.
  • Configure your network or use enterprise policy to block or limit access to sites that may serve malicious JavaScript until the patch is fully deployed.

Generated by OpenCVE AI on November 3, 2026 at 22:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion Enables Remote Code Execution in Chrome
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Tue, 03 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-843
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:42:18.389Z

Reserved: 2026-11-03T09:29:21.122Z

Link: CVE-2026-121094

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-03T21:17:15.257

Modified: 2026-11-03T22:19:36.977

Link: CVE-2026-121094

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T22:30:04Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')