CVE-2026-9896
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An out-of-bounds write vulnerability in the V8 engine of Google Chrome prior to 148.0.7778.216 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Risk Assessment
A remote attacker can execute arbitrary code within the browser sandbox, potentially leading to session takeover, data theft, or further privilege escalation.
Recommendation
Immediately update Google Chrome to version 148.0.7778.216 or later. Ensure update policies cover all user endpoints.
Other vulnerabilities in V8
See all- CVE-2026-14405Critical
In Google Chrome prior to version 150.0.7871.46, an uninitialized use vulnerability exists in the V8 engine. A remote attacker can exploit a crafted HTML page to execute arbitrary code within a sandbox.
- CVE-2025-13223HighActively exploited
A type confusion vulnerability in the V8 engine of Google Chrome prior to version 142.0.7444.175 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as High severity by the Chromium security team.
- CVE-2025-10585CriticalActively exploited
A type confusion vulnerability in the V8 engine in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as high severity.
- CVE-2026-15776High
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-15775Medium
An inappropriate implementation in the V8 JavaScript engine in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue is rated as High severity by the Chromium security team.
- CVE-2026-15770Medium
An uninitialized use vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.125 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- CVE-2026-14432High
A use-after-free vulnerability was found in the V8 engine of Google Chrome prior to version 150.0.7871.46. A remote attacker can exploit a crafted HTML page to execute arbitrary code within the sandbox environment.
- CVE-2026-14431High
A type confusion vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.46 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is rated as high severity.
- CVE-2026-14430High
An integer overflow in the V8 JavaScript engine in Google Chrome prior to version 150.0.7871.46 allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page.
- CVE-2026-14426High
A Use-After-Free vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.46 allows a remote attacker, after convincing a user to perform specific UI gestures, to execute arbitrary code inside a sandbox via a crafted HTML page.
Original NVD description (English source)
Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)