Type Confusion in V8 Engine Allows Out-of-Bounds Access

Publication date: 2026-04-15

Last updated on: 2026-05-27

Assigner: Chrome

Description

Type Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-15

Last Modified

2026-05-27

Generated

2026-07-26

AI Q&A

2026-04-15

EPSS Evaluated

2026-07-25

NVD

CVE-2026-6363

EUVD

EUVD-2026-23092

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 147.0.7727.101 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This vulnerability is a type confusion issue in the V8 JavaScript engine used by Google Chrome versions prior to 147.0.7727.101. It allows a remote attacker to potentially perform out of bounds memory access by crafting a malicious HTML page.

Impact Analysis

Exploitation of this vulnerability can lead to serious impacts including high confidentiality, integrity, and availability risks. An attacker could execute arbitrary code or cause a denial of service by accessing memory out of bounds.

Hi! I’m here to help you understand CVE-2026-6363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70