CVE-2026-0899: Google Chrome V8 RCE Vulnerability

CVE-2026-0899 Overview

CVE-2026-0899 is a high-severity out-of-bounds memory access vulnerability in the V8 JavaScript engine used by Google Chrome. This vulnerability exists in versions prior to 144.0.7559.59 and allows a remote attacker to potentially exploit object corruption through a specially crafted HTML page. The flaw is classified under CWE-125 (Out-of-bounds Read), indicating improper boundary checking when accessing memory.

Critical Impact

Remote attackers can exploit this vulnerability to achieve object corruption in the V8 JavaScript engine by convincing a user to visit a malicious webpage, potentially leading to arbitrary code execution or information disclosure.

Affected Products

• Google Chrome versions prior to 144.0.7559.59
• Chromium-based browsers using vulnerable V8 engine versions
• Applications embedding the affected V8 JavaScript engine

Discovery Timeline

• 2026-01-20 - CVE-2026-0899 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-0899

Vulnerability Analysis

This vulnerability represents an out-of-bounds memory access flaw within Google Chrome's V8 JavaScript engine. V8 is the high-performance JavaScript and WebAssembly engine that powers Chrome and other Chromium-based browsers. The vulnerability allows attackers to read or manipulate memory beyond the intended buffer boundaries, which can lead to object corruption within the JavaScript runtime environment.

The attack requires user interaction—specifically, the victim must navigate to a malicious webpage containing crafted HTML content. Once triggered, the vulnerability can corrupt JavaScript objects in memory, potentially allowing attackers to hijack control flow, leak sensitive information, or achieve arbitrary code execution within the browser's sandbox.

Root Cause

The root cause of CVE-2026-0899 stems from improper bounds checking in the V8 engine when handling certain JavaScript operations or WebAssembly code. This out-of-bounds read condition (CWE-125) occurs when the engine fails to properly validate array indices or pointer arithmetic, allowing access to memory locations outside the allocated buffer. Such memory safety issues in JavaScript engines are particularly dangerous because they can be triggered remotely through web content.

Attack Vector

The attack vector for this vulnerability is network-based and requires user interaction. An attacker must craft a malicious HTML page containing JavaScript code designed to trigger the out-of-bounds access condition in V8. The exploitation sequence typically involves:

1. The attacker hosts or injects malicious JavaScript code into a webpage
2. The victim is lured to visit the malicious page through phishing, malvertising, or compromised legitimate websites
3. The crafted JavaScript triggers the memory access violation in V8
4. Object corruption occurs, potentially allowing further exploitation such as type confusion or arbitrary read/write primitives

For detailed technical information about this vulnerability, refer to the Chromium Issue #458914193 and the Google Chrome Desktop Update announcement.

Detection Methods for CVE-2026-0899

Indicators of Compromise

• Unexpected Chrome browser crashes or hangs when visiting specific websites
• Browser process consuming abnormally high memory before crash
• Chrome crash reports indicating V8 engine failures or memory access violations
• Unusual JavaScript execution patterns detected by endpoint security solutions

Detection Strategies

• Monitor for Chrome versions older than 144.0.7559.59 across the enterprise environment
• Implement browser isolation solutions to contain potential exploitation attempts
• Deploy endpoint detection solutions capable of identifying V8 engine anomalies and memory corruption attempts
• Review browser crash reports for patterns indicating exploitation attempts against V8

Monitoring Recommendations

• Enable enhanced browser telemetry to capture crash diagnostics and JavaScript execution anomalies
• Configure SIEM rules to alert on multiple browser crashes from similar external domains
• Monitor network traffic for known malicious domains associated with browser exploitation campaigns
• Implement web content filtering to block access to untrusted or suspicious websites

How to Mitigate CVE-2026-0899

Immediate Actions Required

• Update Google Chrome to version 144.0.7559.59 or later immediately across all systems
• Enable automatic Chrome updates to ensure timely patching of future vulnerabilities
• Audit enterprise environments for Chromium-based applications that may use the vulnerable V8 engine
• Consider restricting access to untrusted websites until patches are deployed

Patch Information

Google has addressed this vulnerability in Chrome version 144.0.7559.59. The security update is available through Chrome's built-in update mechanism and can be verified through the browser's settings page. Organizations should prioritize deployment of this update given the network-based attack vector and potential for remote code execution.

For official patch details, see the Google Chrome Desktop Update.

Workarounds

• Deploy browser isolation technology to contain potential exploitation within virtualized environments
• Implement strict Content Security Policy (CSP) headers on internal web applications to limit JavaScript execution
• Consider using enterprise browser management to enforce Chrome version requirements
• Enable Site Isolation in Chrome to provide additional process-level isolation between websites

# Verify Chrome version from command line
google-chrome --version
# Expected output should show 144.0.7559.59 or higher

# Force Chrome update check (Linux)
google-chrome --check-for-update-interval=0

# Verify update on Windows via registry
reg query "HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon" /v version