Description
Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-07-01
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A type confusion flaw in the V8 JavaScript engine of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The vulnerability is classified as CWE‑843 and can be triggered by loading a specially crafted HTML page.

Affected Systems

Google Chrome browsers running any revision before 150.0.7871.46 are vulnerable, covering all stable channel releases below that revision. The issue was fixed in Chrome 150.0.7871.46 and later.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while an EPSS score of <1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The vulnerability can be triggered by loading a specially crafted HTML page, allowing code to execute within the browser sandbox with the privileges granted to the user’s browser process.

Generated by OpenCVE AI on July 21, 2026 at 12:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 150.0.7871.46 or later.
  • If an immediate upgrade cannot be performed, block JavaScript execution for untrusted sites or employ browser extensions that restrict script execution.
  • Configure enterprise update policies and monitor Chrome security release channels to ensure prompt application of future patches.

Generated by OpenCVE AI on July 21, 2026 at 12:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Tue, 21 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Type Confusion in V8 Engine

Fri, 17 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title V8 type confusion in Google Chrome allows remote code execution via crafted HTML page

Wed, 15 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Title V8 type confusion in Google Chrome allows remote code execution via crafted HTML page

Tue, 14 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion Allows Remote Code Execution via Crafted HTML

Sun, 12 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion Allows Remote Code Execution via Crafted HTML

Sun, 12 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion Enabling Arbitrary Code Execution via Crafted HTML

Sat, 11 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion Enabling Arbitrary Code Execution via Crafted HTML

Fri, 10 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via V8 Type Confusion in Chrome

Thu, 09 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via V8 Type Confusion in Chrome

Wed, 08 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion in Google Chrome Enabling Remote Code Execution

Tue, 07 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion in Google Chrome Enabling Remote Code Execution

Mon, 06 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Title Type Confusion in V8 JavaScript Engine Enables Remote Code Execution in Chrome

Mon, 06 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
Title Type Confusion in V8 JavaScript Engine Enables Remote Code Execution in Chrome

Sun, 05 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion in Google Chrome Allows Remote Code Execution

Sun, 05 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion in Google Chrome Allows Remote Code Execution

Sat, 04 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title Type Confusion in V8 JavaScript Engine Enables Remote Code Execution

Fri, 03 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Title Type Confusion in V8 JavaScript Engine Enables Remote Code Execution

Fri, 03 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via V8 Type Confusion in Google Chrome

Fri, 03 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via V8 Type Confusion in Google Chrome

Thu, 02 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion Enables Remote Code Execution in Chrome

Thu, 02 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 02 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title V8 Type Confusion Enables Remote Code Execution in Chrome

Thu, 02 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-843
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-03T03:55:52.469Z

Reserved: 2026-07-01T21:37:35.658Z

Link: CVE-2026-14431

cve-icon Vulnrichment

Updated: 2026-07-02T00:17:26.909Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T13:00:04Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')