CVE-2026-82072 in Chrome
Summary
by MITRE • 08/28/2026
Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified as an out-of-bounds read within the V8 JavaScript engine represents a critical memory safety flaw that undermines the integrity of Google Chrome prior to version 151.0.7922.72. This issue stems from improper boundary checks during array or buffer access operations, allowing a script to read data beyond the allocated limits of a memory region. While out-of-bounds reads are traditionally associated with information disclosure vulnerabilities where an attacker might leak sensitive memory contents such as cryptographic keys or session tokens, this specific instance has been classified by Chromium security teams as having higher severity due to its potential for code execution under certain conditions. The flaw occurs when the V8 engine fails to validate that a requested index is within the valid range of a heap-allocated object, leading to an invalid memory access operation.
From a technical perspective, this vulnerability aligns with CWE-125, which describes Out-of-bounds Read vulnerabilities in C and C++ based engines like V8. The exploitation vector involves a crafted HTML page containing malicious JavaScript that triggers the erroneous read condition. By carefully constructing heap objects and manipulating their sizes or indices, an attacker can force the engine to access memory locations outside the intended buffer boundaries. In modern browser architectures, particularly those employing sandboxing mechanisms, such memory corruption issues are significant because they can potentially lead to arbitrary code execution if the out-of-bounds data is used in subsequent operations that influence control flow or pointer values. Although the severity was rated as medium by Chromium, the ability to execute arbitrary code inside the sandbox indicates a severe compromise of the browser's security model.
The operational impact of this vulnerability extends beyond simple data leakage. If an attacker successfully exploits this flaw, they can bypass the browser's sandbox protections and achieve remote code execution on the victim's machine. This capability allows for full system compromise, including the installation of malware, theft of sensitive information stored locally, or using the compromised device as part of a botnet. The attack is delivered via a web page, meaning that social engineering tactics such as phishing links are sufficient to trigger the exploit without requiring any user interaction beyond visiting the malicious site. This highlights the persistent risk posed by complex software components like JavaScript engines where memory management errors can have catastrophic security consequences.
To mitigate this vulnerability, users must ensure they are running Google Chrome version 151.0.7922.72 or later, as these updates contain patches that enforce stricter bounds checking within the V8 engine. Security administrators should prioritize patching cycles to minimize exposure windows for end-users who may inadvertently visit malicious websites. Additionally, employing browser hardening techniques such as disabling JavaScript in untrusted sites or using extensions that restrict script execution can provide an additional layer of defense against exploitation attempts. From a development standpoint, this incident reinforces the importance of rigorous static analysis and fuzzing testing for memory management code to detect out-of-bounds access patterns before they reach production builds. The ATT&CK framework categorizes such exploits under techniques involving client-side scripting abuse, emphasizing the need for continuous monitoring and updated threat intelligence to defend against evolving browser-based attack vectors.