CVE-2026-76043 Overview
CVE-2026-76043 is an incorrect calculation vulnerability [CWE-682] in the V8 JavaScript engine used by Google Chrome. Versions prior to 151.0.7922.169 are affected. A remote attacker can execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. Google's Chromium security team rated this issue as High severity. The flaw is remotely exploitable over the network and requires only minimal user interaction, such as visiting a malicious website.
Critical Impact
Successful exploitation permits arbitrary code execution within the renderer sandbox, providing a foothold that can be chained with a sandbox escape for full compromise of the browser process.
Affected Products
- Google Chrome desktop versions prior to 151.0.7922.169
- Chromium-based browsers incorporating vulnerable V8 builds
- Downstream products embedding the affected V8 engine
Discovery Timeline
- 2026-08-18 - CVE-2026-76043 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76043
Vulnerability Analysis
The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. V8 performs aggressive optimizations that depend on accurate range analysis, type feedback, and arithmetic bounds tracking. An incorrect calculation in one of these routines produces values that diverge from the engine's runtime assumptions.
When the compiler emits optimized code based on the flawed calculation, it removes safety checks that would normally protect memory accesses. A crafted script can then coerce the engine into reading or writing memory outside intended bounds. This confused state within the renderer process leads to arbitrary code execution inside the sandbox.
Exploitation typically requires a user to load a malicious HTML page. Once the attacker's JavaScript runs, it can escalate from the miscomputed value into full control over the renderer.
Root Cause
The root cause is classified as [CWE-682] Incorrect Calculation. V8's optimizer relies on precise numeric reasoning to omit runtime checks. When the calculation logic produces incorrect results, the optimizer's assumptions break, enabling type confusion or out-of-bounds memory access during JIT-compiled execution.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a specially crafted HTML page that delivers JavaScript designed to trigger the miscalculation. When a victim visits the page in an unpatched Chrome build, the exploit gains code execution inside the renderer sandbox. See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for technical details.
No verified proof-of-concept code is publicly available for CVE-2026-76043.
Refer to the Chromium issue tracker once the report is unrestricted.
Detection Methods for CVE-2026-76043
Indicators of Compromise
- Unexpected child processes spawned by chrome.exe or the renderer helper, particularly command shells or scripting hosts.
- Renderer process crashes with access violations in v8.dll or the V8 module preceding suspicious network activity.
- Outbound connections from browser processes to newly registered or low-reputation domains hosting JavaScript-heavy pages.
Detection Strategies
- Inventory Chrome installations across the fleet and flag any version below 151.0.7922.169 as vulnerable.
- Monitor endpoint telemetry for anomalous behavior originating from browser renderer processes, including code injection and memory allocation patterns typical of JIT exploitation.
- Correlate web proxy logs with endpoint alerts to identify users who visited attacker-controlled pages immediately before renderer instability.
Monitoring Recommendations
- Enable browser crash reporting and centralize collection so exploitation attempts producing V8 crashes are surfaced quickly.
- Alert on process ancestry patterns where Chrome renderer processes create persistence artifacts or invoke living-off-the-land binaries.
- Track EPSS movement for CVE-2026-76043 to reprioritize response as exploitation likelihood shifts.
How to Mitigate CVE-2026-76043
Immediate Actions Required
- Update Google Chrome to version 151.0.7922.169 or later on all managed endpoints without delay.
- Restart Chrome after the update so the patched V8 binary is loaded into memory.
- Push equivalent fixed builds for Chromium-based browsers such as Microsoft Edge, Brave, and Opera once vendors publish downstream releases.
Patch Information
Google addressed the issue in the Stable channel update announced in the Google Chrome Update Announcement. The fix ships in Chrome 151.0.7922.169 and later. Enterprises using Chrome Browser Enterprise policies should confirm auto-update is enforced and validate the deployed version via chrome://version.
Workarounds
- Restrict browsing to trusted destinations through enterprise proxy allowlists until patching completes.
- Deploy site isolation and enhanced Safe Browsing policies via Chrome Enterprise to reduce exposure to malicious pages.
- Consider temporarily disabling JavaScript on high-risk user groups where a delay in patching is unavoidable.
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Force update on macOS managed fleets
sudo /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot -userInitiated YES
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
