CVE-2026-0902: Google Chrome V8 RCE Vulnerability

CVE-2026-0902 Overview

CVE-2026-0902 is an inappropriate implementation vulnerability in the V8 JavaScript engine used by Google Chrome prior to version 144.0.7559.59. This out-of-bounds memory read vulnerability allows a remote attacker to potentially access sensitive memory contents through a specially crafted HTML page. The vulnerability is categorized under CWE-474 (Use of Function with Inconsistent Implementations), indicating an underlying issue with how certain functions are implemented within the V8 engine.

Critical Impact

Remote attackers can exploit this vulnerability by luring victims to malicious web pages, potentially leading to information disclosure, data exfiltration, or serving as a stepping stone for further exploitation chains.

Affected Products

• Google Chrome versions prior to 144.0.7559.59
• Chromium-based browsers using vulnerable V8 engine versions
• Applications embedding the affected V8 JavaScript engine

Discovery Timeline

• 2026-01-20 - CVE-2026-0902 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-0902

Vulnerability Analysis

This vulnerability stems from an inappropriate implementation in V8, Google Chrome's JavaScript engine responsible for parsing and executing JavaScript code. The flaw enables an out-of-bounds memory read condition, which occurs when the engine attempts to access memory locations outside the boundaries of allocated buffers.

Out-of-bounds read vulnerabilities in JavaScript engines like V8 are particularly dangerous because they can be triggered simply by visiting a malicious webpage. The V8 engine processes JavaScript from any website the user visits, making browser users susceptible to drive-by attacks. When exploited, attackers can read sensitive data from memory that should be inaccessible, potentially exposing cryptographic keys, session tokens, or other confidential information stored in the browser's memory space.

Root Cause

The root cause is classified under CWE-474 (Use of Function with Inconsistent Implementations), indicating that the vulnerability arises from inconsistent behavior in function implementations within the V8 engine. This type of weakness occurs when code relies on assumptions about function behavior that do not hold true across all execution paths, leading to unexpected memory access patterns.

In the context of V8, this could manifest when the JavaScript Just-In-Time (JIT) compiler makes optimization assumptions that do not align with the actual memory layout, causing subsequent operations to read beyond intended buffer boundaries.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must craft a malicious HTML page containing JavaScript code designed to trigger the vulnerable code path in V8. The attack sequence typically involves:

1. The attacker hosts or injects malicious JavaScript into a web page
2. The victim navigates to the compromised page using a vulnerable Chrome browser
3. The V8 engine processes the malicious script, triggering the out-of-bounds read
4. Sensitive memory contents are exposed to the attacker's script

The vulnerability is particularly concerning because it requires no special privileges and can be exploited remotely through standard web browsing activity. For technical details, refer to the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-0902

Indicators of Compromise

• Unexpected Chrome renderer process crashes or unusual memory access errors in crash logs
• Network traffic to suspicious or newly registered domains serving JavaScript-heavy content
• Browser console errors related to V8 engine memory operations
• Detection of obfuscated JavaScript attempting array or TypedArray manipulations

Detection Strategies

• Monitor for Chrome versions below 144.0.7559.59 across the enterprise using software inventory tools
• Implement web filtering to block access to known malicious domains distributing browser exploits
• Deploy endpoint detection solutions capable of identifying anomalous browser behavior and memory access patterns
• Analyze JavaScript execution patterns for suspicious out-of-bounds access attempts using browser-based security extensions

Monitoring Recommendations

• Enable Chrome's built-in Safe Browsing feature and ensure it is not disabled by users or group policies
• Configure centralized logging for browser crash reports to identify potential exploitation attempts
• Monitor for unusual network connections from browser processes to unknown external hosts
• Implement Content Security Policy (CSP) headers on internal web applications to reduce attack surface

How to Mitigate CVE-2026-0902

Immediate Actions Required

• Update Google Chrome to version 144.0.7559.59 or later immediately across all systems
• Enable automatic updates for Chrome to ensure timely patching of future vulnerabilities
• Consider temporarily restricting access to untrusted websites until patching is complete
• Notify users about the importance of not visiting untrusted links until their browsers are updated

Patch Information

Google has addressed this vulnerability in Chrome version 144.0.7559.59. The fix is available through Chrome's standard update mechanism. Organizations should verify that automatic updates are enabled and functioning correctly. For detailed patch information, see the Google Chrome Desktop Update announcement.

To verify your Chrome version, navigate to chrome://settings/help or click Menu → Help → About Google Chrome. The browser will display the current version and automatically check for updates.

Workarounds

• Enable Chrome's Site Isolation feature (chrome://flags/#enable-site-per-process) to limit cross-site memory exposure
• Consider using browser profiles with restricted JavaScript execution for untrusted browsing
• Implement network-level filtering to block known malicious JavaScript payloads
• Deploy enterprise browser policies to restrict access to high-risk websites until patches are applied

# Verify Chrome version on Windows systems
reg query "HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon" /v version

# Verify Chrome version on Linux systems
google-chrome --version

# Force Chrome update via command line (Windows)
"%ProgramFiles%\Google\Chrome\Application\chrome.exe" --check-for-update-interval=1