CVE-2026-14431
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A type confusion vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.46 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is rated as high severity.
Risk Assessment
An attacker can remotely execute arbitrary code within the browser's sandbox, potentially leading to session takeover, data theft, or further privilege escalation.
Recommendation
Immediately update Google Chrome to version 150.0.7871.46 or later. Users should also consider enabling automatic updates.
Other vulnerabilities in V8
See all- CVE-2026-14405Critical
In Google Chrome prior to version 150.0.7871.46, an uninitialized use vulnerability exists in the V8 engine. A remote attacker can exploit a crafted HTML page to execute arbitrary code within a sandbox.
- CVE-2025-13223HighActively exploited
A type confusion vulnerability in the V8 engine of Google Chrome prior to version 142.0.7444.175 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as High severity by the Chromium security team.
- CVE-2025-10585CriticalActively exploited
A type confusion vulnerability in the V8 engine in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as high severity.
- CVE-2026-15776High
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-15775Medium
An inappropriate implementation in the V8 JavaScript engine in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue is rated as High severity by the Chromium security team.
- CVE-2026-15770Medium
An uninitialized use vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.125 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- CVE-2026-14432High
A use-after-free vulnerability was found in the V8 engine of Google Chrome prior to version 150.0.7871.46. A remote attacker can exploit a crafted HTML page to execute arbitrary code within the sandbox environment.
- CVE-2026-14430High
An integer overflow in the V8 JavaScript engine in Google Chrome prior to version 150.0.7871.46 allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page.
- CVE-2026-14426High
A Use-After-Free vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.46 allows a remote attacker, after convincing a user to perform specific UI gestures, to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-14409High
An inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker, after convincing a user to perform specific UI gestures, to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is rated as low severity.
Original NVD description (English source)
Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)