Loading vulnerability…
Sandboxed arbitrary code execution in Google Chrome V8
CVE-2026-126874 is a high-severity type confusion vulnerability in the V8 engine in Google Chrome versions before 157.0.8103.78. A remote attacker can trigger the vulnerability through a crafted HTML page to execute arbitrary code inside the Chrome sandbox. The specific vulnerable function and underlying implementation details are not available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the Chrome sandbox, potentially compromising the confidentiality, integrity, and availability of resources accessible to the affected sandboxed process. The vulnerability alone does not establish sandbox escape or host-level compromise.
Patch, then assume compromise.
Upgrade Google Chrome to version 157.0.8103.78 or later and relaunch the browser to activate the update. Administrators should verify installation across managed devices rather than assume automatic updates have completed. A fixed Debian Chromium package version is not specified.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.