CVE-2026-106240: V8 type confusion in Google Chrome before 155.0.8059.39 · ZeroHour

CVE-2026-106240

mass

V8 type confusion in Google Chrome before 155.0.8059.39

CVSS 3.1

8.8 high

EPSS

—

Published

Oct 6, 2026 (2d ago)

Modified

Oct 7, 2026

AI analysis

A type confusion flaw (CWE-843) in the V8 JavaScript engine in Google Chrome prior to 155.0.8059.39 allows a remote attacker to execute arbitrary code inside the browser sandbox. It is triggered when a user opens a crafted HTML page; no privileges are required beyond that interaction, and the attack is network-reachable (CVSS 3.1 base score 8.8, High). Successful exploitation can fully affect confidentiality, integrity, and availability inside the sandbox, with scope unchanged. Anyone running an unpatched Google Chrome build older than 155.0.8059.39 is affected. No public proof of concept is known, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Update Google Chrome to version 155.0.8059.39 or later and fully restart the browser so the fixed build is loaded. Until then, avoid opening untrusted HTML pages and links, and confirm the installed version under chrome://settings/help.

Affected

Google Chrome

prior to 155.0.8059.39

Estimated exposure

masson the order of billions of Chrome installations worldwide — Google Chrome is the dominant web browser with a multi-billion-user install base; every build older than 155.0.8059.39 is in scope until updated. This is an order-of-magnitude estimate from public market-share patterns, not a device scan.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-843
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-106240

In the news1 stories

Update Chrome and ChromeOS to fix critical security issues