Google Chrome V8 vulnerabilities

Type Confusion in V8 in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Out of bounds memory access in V8 in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Out of bounds read and write in V8 in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Type Confusion in V8 in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

A vulnerability in the V8 JavaScript engine in Google Chrome prior to 144.0.7559.59 is caused by inappropriate implementation, potentially leading to object corruption. A remote attacker can exploit this by delivering a crafted HTML page.

CVE-2026-0899 is a vulnerability in the V8 engine of Google Chrome prior to version 144.0.7559.59. It involves out-of-bounds memory access, which can lead to object corruption. A remote attacker can exploit this flaw via a crafted HTML page.

Inappropriate handling of table size in V8 in Google Chrome prior to version 61.0.3163.100 for Windows allows a remote attacker to trigger out-of-bounds access via a crafted HTML page.

Inappropriate use of JIT optimisation in V8 in Google Chrome prior to version 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.

Type confusion in V8 in Google Chrome prior to version 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Type confusion in V8 in Google Chrome prior to version 61.0.3163.79 for Windows allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.

A use after free in V8 in Google Chrome prior to version 60.0.3112.78 for Mac, Windows, Linux, and Android allows a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Insufficient validation of untrusted input in V8 in Google Chrome prior to version 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.

An out-of-bounds read in V8 in Google Chrome prior to version 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to obtain heap memory contents via a crafted HTML page.

Use-after-free vulnerability in V8 in Google Chrome before version 53.0.2785.143 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via unknown vectors.

A heap buffer overflow in V8 in Google Chrome prior to version 56.0.2924.76 for Linux, Windows, and Mac, and prior to version 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

A use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

V8 in Google Chrome prior to version 54.0.2840.98 for Mac, 54.0.2840.99 for Windows, 54.0.2840.100 for Linux, and 55.0.2883.84 for Android incorrectly applied type rules, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Out of bounds memory access in V8 in Google Chrome prior to version 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Out of bounds memory access in V8 in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Type Confusion in V8 in Google Chrome prior to version 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.

An out-of-bounds read in V8 in Google Chrome prior to version 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page.

Inappropriate implementation in V8 in Google Chrome prior to version 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Type confusion in V8 in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Type Confusion in V8 in Google Chrome prior to version 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.

Type Confusion in V8 in Google Chrome prior to version 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Type confusion in V8 in Google Chrome prior to version 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.