Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
NVD: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Hunt for Chrome renderer crashes with V8 JIT stack traces (Maglev/TurboFan) after visits to suspicious domains — TryReduceArrayPrototypeSort type confusion yields addrof/fakeobj primitives. Monitor EDR for child processes from chrome.exe.
Research details
ComponentV8 Maglev and TurboFan JIT compilers — TryReduceArrayPrototypeSort in maglev/maglev-graph-builder.cc
PreconditionsUser must visit a crafted HTML page containing JavaScript that triggers V8 Maglev or TurboFan inline sort optimization on mixed PACKED_ELEMENTS/PACKED_SMI_ELEMENTS arrays with a comparator callback that calls Array.prototype.fill; affects Chrome versions prior to 152.0.7977.82 on all platforms; no authentication required; delivery requires user interaction such as clicking a link or visiting a compromised page agent
Deliverycrafted HTML page with JavaScript triggering V8 inline sort optimization
Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 8.8) | The bug was present in both Maglev and TurboFan JIT compilers; researcher Salvatore Gulizia (Serotav) confirmed the type confusion primitive yields arbitrary read/write on the JS heap and was chained with an n-day sandbox escape; Google withheld in-the-wild exploit details; no fully weaponized public PoC exists
SummaryA type confusion vulnerability in V8 Maglev and TurboFan JIT compilers allows remote code execution inside the Chrome renderer sandbox via crafted HTML. The flaw in TryReduceArrayPrototypeSort permits a comparator callback to switch the receiver map via Array fill, corrupting element type assumptions after copy-back and yielding addrof and fakeobj primitives that escalate to arbitrary read-write on the JavaScript heap. Google confirmed active exploitation in the wild and released Chrome 152 to fix the sixth zero-day of 2026.
Tia coverage
First reported2026-09-04
First exploit report2026-09-04
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.