CVE-2026-15776
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code within the sandboxed environment, potentially compromising the confidentiality, integrity, or availability of data within the user's browser.
Recommendation
Immediately update Google Chrome to version 150.0.7871.125 or later, which includes a fix for this vulnerability.
Other vulnerabilities in V8
See all- CVE-2026-14405Critical
In Google Chrome prior to version 150.0.7871.46, an uninitialized use vulnerability exists in the V8 engine. A remote attacker can exploit a crafted HTML page to execute arbitrary code within a sandbox.
- CVE-2025-13223HighActively exploited
A type confusion vulnerability in the V8 engine of Google Chrome prior to version 142.0.7444.175 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as High severity by the Chromium security team.
- CVE-2025-10585CriticalActively exploited
A type confusion vulnerability in the V8 engine in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as high severity.
- CVE-2026-15775Medium
An inappropriate implementation in the V8 JavaScript engine in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue is rated as High severity by the Chromium security team.
- CVE-2026-15770Medium
An uninitialized use vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.125 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- CVE-2026-14432High
A use-after-free vulnerability was found in the V8 engine of Google Chrome prior to version 150.0.7871.46. A remote attacker can exploit a crafted HTML page to execute arbitrary code within the sandbox environment.
- CVE-2026-14431High
A type confusion vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.46 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is rated as high severity.
- CVE-2026-14430High
An integer overflow in the V8 JavaScript engine in Google Chrome prior to version 150.0.7871.46 allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page.
- CVE-2026-14426High
A Use-After-Free vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.46 allows a remote attacker, after convincing a user to perform specific UI gestures, to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-14409High
An inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker, after convincing a user to perform specific UI gestures, to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is rated as low severity.
Original NVD description (English source)
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)