CVE-2026-78910: Google Chrome V8 Buffer Overflow Vulnerability

CVE-2026-78910 Overview

CVE-2026-78910 is a buffer overflow vulnerability [CWE-121] in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can exploit the vulnerability by luring a user to a crafted HTML page. Successful exploitation results in arbitrary code execution inside the Chrome renderer sandbox. Google's Chromium team rates the internal security severity as Medium, while the National Vulnerability Database scores it 8.8 (High).

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a malicious HTML page, providing an initial foothold that can be chained with a sandbox escape for full compromise.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable V8 build
Desktop platforms served by the Chrome Stable channel

Discovery Timeline

2026-08-25 - CVE-2026-78910 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78910

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine embedded in Chrome. A crafted HTML page can trigger a buffer overflow condition during script execution. The overflow allows an attacker to corrupt adjacent memory within the renderer process. Chromium's issue tracker entry #511260796 records the internal handling of the report.

Code execution occurs inside the Chrome sandbox, which limits direct access to the host operating system. Attackers typically pair a V8 renderer exploit with a separate sandbox escape to achieve system-level compromise. The Chromium security team classifies the intrinsic severity as Medium, reflecting the sandbox boundary that remains between the attacker and the host.

Root Cause

Buffer overflow flaws in V8 typically stem from incorrect bounds handling in optimized JIT-compiled code paths, type confusion during speculative optimization, or missing length checks in built-in operations on typed arrays and strings. The NVD entry classifies this issue as CWE-121 (Stack-based Buffer Overflow). Public technical details beyond the Chromium issue reference and the Stable Channel release notes have not been released.

Attack Vector

Exploitation requires a victim to load attacker-controlled HTML in a vulnerable Chrome build. The malicious page delivers JavaScript that drives V8 into the vulnerable code path. No authentication or prior privileges are required, but user interaction (visiting the page) is necessary. Common delivery methods include drive-by downloads, malicious advertisements, and phishing links.

The vulnerability is described in prose only because no verified public exploit code exists. See the Chromium Issue Tracker #511260796 for the authoritative technical reference.

Detection Methods for CVE-2026-78910

Indicators of Compromise

Chrome browser processes launching unexpected child processes such as command shells or scripting hosts shortly after web navigation.
Unpatched Chrome installations reporting a version string below 152.0.7977.65 in inventory data.
Renderer process crashes with heap or stack corruption signatures logged around the time of visits to untrusted sites.

Detection Strategies

Inventory browser versions across managed endpoints and flag Chrome installations older than 152.0.7977.65.
Alert on anomalous process lineage where chrome.exe spawns cmd.exe, powershell.exe, wscript.exe, or other interpreters.
Correlate web proxy logs with endpoint telemetry to identify users navigating to known malicious domains from vulnerable Chrome builds.

Monitoring Recommendations

Monitor DNS and HTTP telemetry for connections to newly registered or low-reputation domains hosting HTML and JavaScript payloads.
Track WER, breakpad, or crashpad reports for repeated renderer crashes that may indicate exploitation attempts.
Ingest browser and endpoint telemetry into a centralized data lake to enable retroactive hunting once additional indicators are published.

How to Mitigate CVE-2026-78910

Immediate Actions Required

Update Chrome to version 152.0.7977.65 or later on all managed endpoints.
Restart the browser after applying the update to ensure the patched V8 build is loaded.
Audit Chromium-based browsers and embedded frameworks (Electron, CEF) and update to versions that incorporate the fixed V8 release.

Patch Information

Google addressed CVE-2026-78910 in the Chrome Stable channel release announced in the Google Chrome Stable Update. The fixed version is 152.0.7977.65 for desktop platforms. Users on Chrome's automatic update channel receive the patch once the browser is relaunched. Enterprise administrators using managed policies should confirm rollout across all update rings.

Workarounds

Enforce browser update policies through group policy or MDM so users cannot postpone Chrome relaunches.
Restrict access to untrusted websites via web filtering while patch deployment is in progress.
Deploy site isolation and strict per-site process policies to limit the blast radius of renderer compromises.

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify Chrome version on Linux endpoints
google-chrome --version