Executive brief
Google Chrome's V8 JavaScript engine contains a race condition flaw that allows attackers to bypass the browser's sandbox protection and execute arbitrary code. An attacker can exploit this vulnerability by crafting a malicious HTML page; when a user visits the page, the attacker gains the ability to run code with the privileges of the Chrome process, potentially leading to data theft, malware installation, or system compromise.
Technical details
A race condition exists in Google Chrome's V8 JavaScript engine that permits sandbox escape and arbitrary code execution. The vulnerability is triggered when a user visits a crafted HTML page that exploits timing issues in V8's memory management or threading logic. The race condition allows an attacker to bypass sandbox isolation, gaining the ability to execute arbitrary code within the Chrome process context. This represents a sandbox escape—one of the most severe classes of browser vulnerabilities. The flaw was patched in Chrome version 152.0.7977.65 and later releases.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed: CVE-2026-78901 disclosed; Chrome 152.0.7977.65 released with fix