CVE-2026-76047: Google Chrome V8 RCE Vulnerability

CVE-2026-76047 Overview

CVE-2026-76047 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.169 and allows a remote attacker to execute arbitrary code inside the renderer sandbox. Exploitation requires a victim to load a crafted HTML page. The vulnerability maps to CWE-843: Access of Resource Using Incompatible Type. Google classifies the Chromium security severity as High.

Critical Impact
A crafted web page can trigger arbitrary code execution inside the Chrome renderer, giving attackers a foothold for further sandbox escape chains and drive-by compromise.

Affected Products

Google Chrome versions prior to 151.0.7922.169
Chromium-based browsers sharing the same V8 build
Desktop Chrome distributions on Windows, macOS, and Linux

Discovery Timeline

2026-08-18 - CVE-2026-76047 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76047

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. Type confusion occurs when V8 treats a memory object as one type while it was allocated or initialized as another. Attackers weaponize this mismatch to read or write memory outside intended object boundaries. In V8, such flaws typically arise in the optimizing compiler pipeline (TurboFan or Maglev), where speculative type assumptions can diverge from runtime object shapes. Once triggered, the primitive enables arbitrary read and write inside the renderer process, leading to code execution within the sandbox.

Root Cause

The root cause is an incompatible type access in V8's object handling. When JavaScript execution reaches the vulnerable code path, V8 dereferences an object under an assumed type that does not match its actual layout. This mismatch corrupts internal invariants and produces exploitable memory corruption. Google's Chromium issue tracker entry 541251902 contains restricted details on the exact component.

Attack Vector

Exploitation is remote and requires user interaction limited to visiting a malicious web page. An attacker hosts a crafted HTML document containing JavaScript that manipulates object types to trigger the confusion in V8. No authentication is needed. Because the impact is contained by the renderer sandbox, attackers typically chain this bug with a separate sandbox escape to achieve full system compromise. See the Chromium Issue Tracker entry for the tracking record.

Detection Methods for CVE-2026-76047

Indicators of Compromise

Chrome renderer processes crashing with signatures pointing to V8 optimized code frames
Unexpected child processes spawned by chrome.exe following browsing sessions
Outbound connections to unfamiliar domains immediately after page loads containing heavy JavaScript
Browser telemetry showing users on Chrome builds earlier than 151.0.7922.169

Detection Strategies

Inventory endpoints for Chrome versions and flag any build below 151.0.7922.169
Inspect proxy and DNS logs for traffic to newly registered domains serving JavaScript-heavy pages
Correlate renderer crash dumps with browsing history to identify suspicious pages

Monitoring Recommendations

Alert on Chrome child processes launching shells, script interpreters, or LOLBins
Monitor for unsigned or unexpected DLL loads into Chrome processes
Track file writes to user profile directories immediately following browser activity

How to Mitigate CVE-2026-76047

Immediate Actions Required

Update Google Chrome to version 151.0.7922.169 or later on all managed endpoints
Restart Chrome after patching to ensure the vulnerable V8 build is unloaded from memory
Push equivalent updates to Chromium-based browsers such as Edge, Brave, and Opera as vendors ship them
Restrict execution of unpatched Chrome installations via application control policies

Patch Information

Google released the fix in the Stable channel update documented in the Chrome Stable Update Notice. Administrators should deploy Chrome 151.0.7922.169 or later. Enterprise deployments using Chrome Browser Cloud Management or group policy should force the update and verify version compliance across the fleet.

Workarounds

Disable JavaScript for untrusted sites through Chrome enterprise policy DefaultJavaScriptSetting
Enforce Site Isolation and strict per-site process separation to raise exploitation cost
Route browsing through a remote browser isolation service until patching is complete

bash

# Configuration example: enforce minimum Chrome version via Chrome Enterprise policy (Linux master_preferences)
{
  "browser": {
    "show_home_button": true
  },
  "MinimumChromeVersion": "151.0.7922.169",
  "DefaultJavaScriptSetting": 2,
  "JavaScriptAllowedForUrls": [
    "https://[*.]corp.example.com"
  ]
}