CVE-2026-1862: Google Chrome V8 RCE Vulnerability

CVE-2026-1862 Overview

CVE-2026-1862 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 144.0.7559.132. A remote attacker can exploit heap corruption by serving a crafted HTML page to a target user. Successful exploitation can lead to arbitrary code execution within the renderer process. The flaw affects Chrome on Windows, macOS, and Linux. Google classifies the Chromium security severity as High, and the issue is tracked under CWE-843: Access of Resource Using Incompatible Type.

Critical Impact

A single visit to a malicious web page can trigger heap corruption in the V8 engine, enabling remote code execution in the renderer and a path toward sandbox escape.

Affected Products

• Google Chrome prior to 144.0.7559.132
• Chromium-based browsers on Microsoft Windows, Apple macOS, and Linux
• Microsoft products incorporating the affected Chromium build (see Microsoft CVE Update Guide)

Discovery Timeline

• 2026-02-03 - CVE-2026-1862 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-1862

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. V8 applies aggressive optimizations based on assumed object shapes and types. When the engine treats a memory region as one type while it is actually another, attacker-controlled data can be interpreted as pointers or object headers. This mismatch corrupts the heap and allows the attacker to influence control flow within the renderer process. Exploitation requires only that the victim load a crafted HTML page. The attack vector is network-based and requires user interaction, but no prior authentication.

Root Cause

The root cause is improper type checking inside V8 [CWE-843]. Optimized code paths in the just-in-time (JIT) compiler or runtime accept an object as one type without validating that its hidden class or shape still matches expectations. When the actual type differs, V8 reads or writes memory using the wrong field offsets and sizes, producing heap corruption.

Attack Vector

An attacker hosts a malicious page containing JavaScript designed to trigger the type confusion. When a victim visits the page in an unpatched Chrome build, the script forces V8 into an inconsistent state, then leverages the corrupted object to read and write arbitrary memory inside the renderer. From there, attackers typically chain a sandbox escape to achieve code execution on the host. No public proof-of-concept is currently listed, and the issue is not on the CISA Known Exploited Vulnerabilities catalog. Technical details remain restricted in the Chromium Issue Tracker entry.

Detection Methods for CVE-2026-1862

Indicators of Compromise

• Chrome renderer processes crashing with access violations shortly after browsing untrusted sites
• Unexpected child processes spawned by chrome.exe following navigation to a new domain
• Outbound connections from Chrome renderer or helper processes to uncommon hosts immediately after page load

Detection Strategies

• Inventory installed Chrome versions across the fleet and flag any build below 144.0.7559.132
• Hunt for HTML or JavaScript payloads delivered from low-reputation domains that contain heavy V8 type manipulation patterns
• Correlate browser crash telemetry with proxy logs to identify pages that consistently destabilize the renderer

Monitoring Recommendations

• Forward Chrome crash dumps and Windows Error Reporting data to a central log store for review
• Monitor process creation events where chrome.exe is the parent of shells, scripting hosts, or LOLBins
• Track DNS and HTTP telemetry for newly registered domains serving HTML to Chrome user agents

How to Mitigate CVE-2026-1862

Immediate Actions Required

• Update Google Chrome to version 144.0.7559.132 or later on Windows, macOS, and Linux endpoints
• Restart browsers after the update so the patched V8 binary is loaded into memory
• Apply the corresponding Microsoft Edge and other Chromium-derived browser updates referenced in the Microsoft CVE Update Guide

Patch Information

Google addressed CVE-2026-1862 in the Stable channel update announced on the Chrome Releases blog. Administrators should enforce the update through enterprise management tooling and verify rollout via the chrome://settings/help version string. Downstream Chromium projects must consume the same V8 fix before they are considered remediated.

Workarounds

• Restrict browsing to trusted sites using web filtering or DNS controls until patches are deployed
• Enable Chrome Enterprise policies that block execution of JavaScript on uncategorized or newly registered domains
• Use site isolation and disable unnecessary browser extensions to reduce the renderer attack surface

# Verify the installed Chrome version on Linux endpoints
google-chrome --version

# Example Windows policy to force automatic updates via registry
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f