Executive brief
Google Chrome's V8 JavaScript engine contains a race condition vulnerability that allows a remote attacker to execute arbitrary code within the Chrome sandbox by hosting a malicious HTML page. An attacker can trick users into visiting a crafted website to gain code execution inside the browser's sandboxed environment, potentially leading to data theft, malware installation, or further exploitation of the user's system.
Technical details
A race condition exists in the V8 JavaScript engine included in Google Chrome prior to version 152.0.7977.82. The vulnerability allows arbitrary code execution within the sandbox via a crafted HTML page. The attack requires no user authentication and is triggered by network-reachable vectors—specifically, visiting a malicious website. An attacker can craft HTML that triggers the race condition to achieve code execution in the V8 sandbox. The vulnerability was patched in Chrome version 152.0.7977.82/.83 (Windows/Mac) and 152.0.7977.82 (Linux), released on September 3, 2026.
Affected products
- Google Chrome prior to 152.0.7977.82
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched