CVE-2026-78956: Google Chrome V8 Type Confusion RCE Vulnerability

CVE-2026-78956 Overview

CVE-2026-78956 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 152.0.7977.65. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. The flaw is classified under CWE-843: Access of Resource Using Incompatible Type and requires user interaction to trigger. Google rated the underlying Chromium bug as Low severity, while the National Vulnerability Database assigns it a High severity rating due to the confidentiality, integrity, and availability impact on the affected renderer process.

Critical Impact
Successful exploitation allows arbitrary code execution inside the Chrome renderer sandbox on unpatched systems, providing attackers a foothold that can be chained with a sandbox escape for full system compromise.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding vulnerable V8 builds
All operating system builds of Chrome (Windows, macOS, Linux) prior to the fixed release

Discovery Timeline

2026-08-25 - CVE-2026-78956 published to the National Vulnerability Database
2026-08-27 - CVE-2026-78956 last updated in NVD

Technical Details for CVE-2026-78956

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. Type confusion occurs when the engine allocates or accesses a memory region as one type while treating it as another incompatible type at runtime. In V8, this class of bug typically stems from optimization paths in TurboFan or Maglev where type feedback assumptions do not match the actual object shape at execution time.

An attacker who controls the JavaScript executed by a victim can force the engine into an inconsistent state. The mismatch enables the attacker to read or write memory outside the intended object boundary. From there, the attacker constructs primitives that lead to arbitrary code execution within the renderer process.

The issue is tracked in the Chromium Issue Tracker Entry and fixed in the Stable Channel Update announcement.

Root Cause

The root cause is improper type validation inside V8, categorized as [CWE-843]. V8 speculatively optimizes JavaScript based on observed object types. When the engine fails to correctly deoptimize or guard against a type change, subsequent operations reinterpret memory using an incorrect type layout. This produces confusion between object shapes, pointers, and inline data.

Attack Vector

The attack is remote and requires user interaction. An attacker hosts a crafted HTML page containing malicious JavaScript designed to trigger the type confusion in V8. The victim must load the page in a vulnerable Chrome build, typically through phishing, malvertising, or a compromised website. Code execution is confined to the renderer sandbox unless combined with a separate sandbox escape.

No public proof-of-concept or exploit is currently listed for CVE-2026-78956, and it does not appear on the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.385%.

Detection Methods for CVE-2026-78956

Indicators of Compromise

Chrome renderer processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters on Linux and macOS
Outbound network connections from chrome.exe to newly registered or low-reputation domains hosting HTML payloads
Unexpected browser crashes referencing V8 modules, JIT regions, or non-executable memory faults
Users reporting visits to unfamiliar links delivered by phishing or malvertising campaigns

Detection Strategies

Monitor endpoint telemetry for Chrome process trees where the renderer or GPU process launches unusual descendants
Inspect proxy and DNS logs for traffic to domains hosting large obfuscated JavaScript payloads that call V8 optimizer internals
Correlate browser crash dumps with signals of memory corruption in the V8 heap

Monitoring Recommendations

Track Chrome version inventory across the fleet and alert when hosts run builds prior to 152.0.7977.65
Enable browser telemetry forwarding to a central SIEM for review of crash and exploitation signals
Baseline normal Chrome child-process activity and alert on deviations, particularly script interpreters and living-off-the-land binaries

How to Mitigate CVE-2026-78956

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force-restart the browser after update deployment to ensure the patched V8 build is loaded
Audit and remove unnecessary Chrome extensions that broaden the attack surface
Deliver user awareness communications warning against clicking untrusted links, since exploitation requires user interaction

Patch Information

Google addressed CVE-2026-78956 in the Chrome Stable channel release 152.0.7977.65 for Desktop. Details are available in the Google Chrome Update Announcement. Administrators should push the update through enterprise management channels such as Chrome Browser Cloud Management, Group Policy, or Jamf.

Workarounds

Disable JavaScript for untrusted sites through Chrome enterprise policy to reduce V8 attack surface
Restrict browsing on sensitive systems to allow-listed domains until patching completes
Deploy site isolation and strict sandboxing policies to limit the impact of renderer compromise
Use application allow-listing to prevent Chrome child processes from spawning script interpreters

bash

# Enterprise policy example: disable JavaScript on all sites except an allow list
# Windows Group Policy registry keys under HKLM\SOFTWARE\Policies\Google\Chrome
DefaultJavaScriptSetting=2
JavaScriptAllowedForUrls=["https://intranet.example.com","https://saas.example.com"]