CVE-2026-5279
Object Corruption in V8 Engine Enables High-Severity Remote Code Execution
Publication date: 2026-04-01
Last updated on: 2026-04-02
Assigner: Chrome
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chrome | to 146.0.7680.177 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an object corruption issue in the V8 JavaScript engine used by Google Chrome versions prior to 146.0.7680.178. It allows a remote attacker to execute arbitrary code within a sandboxed environment by tricking the browser into processing a specially crafted HTML page.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker could run arbitrary code on your system inside the sandboxed environment of the browser. This could potentially lead to unauthorized actions or compromise of data within the browser context, although the sandbox limits the scope of the attack.