CVE-2026-82072: Google Chrome V8 RCE Vulnerability

CVE-2026-82072 Overview

CVE-2026-82072 is an out-of-bounds read vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 151.0.7922.72. A remote attacker can execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The flaw is tracked upstream as Chromium issue 534416978 and is classified under [CWE-125: Out-of-bounds Read]. Google rates the Chromium security severity as Medium, while the National Vulnerability Database assigns a higher CVSS base score due to the potential for arbitrary code execution and user interaction requirement.

Critical Impact
Successful exploitation lets a remote attacker execute arbitrary code inside the V8 sandbox by serving a crafted HTML page, opening the door to further sandbox escape chaining.

Affected Products

Google Chrome versions prior to 151.0.7922.72 (Desktop Stable channel)
Chromium-based V8 engine builds before the July 2026 Stable channel update
Downstream Chromium-derived browsers that had not yet integrated the V8 fix

Discovery Timeline

2026-08-28 - CVE-2026-82072 published to the National Vulnerability Database
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-82072

Vulnerability Analysis

The vulnerability is an out-of-bounds read inside V8, the JavaScript and WebAssembly engine that powers Chrome. V8 compiles JavaScript into optimized machine code and manages its own heap for objects, typed arrays, and JIT-generated code. When a compiler or runtime routine reads memory outside the intended object bounds, it can leak adjacent heap data or corrupt state used for later control-flow decisions.

According to the vendor advisory, an attacker who successfully triggers the condition can execute arbitrary code inside the V8 sandbox. The V8 sandbox is an in-process isolation layer meant to contain memory corruption in the engine, so exploitation is scoped to that boundary rather than immediately yielding host-level code execution. The Chromium project rates the underlying issue as Medium severity.

Root Cause

The root cause is an out-of-bounds read [CWE-125] in V8. Read primitives of this class typically arise from missing or incorrect bounds checks on typed array indices, incorrect assumptions in the optimizing compiler about object shape or element kinds, or stale length metadata after a side-effectful operation. Google has not published detailed root-cause information, and Chromium issue 534416978 remains restricted while users update.

Attack Vector

Exploitation requires the victim to load attacker-controlled web content in a vulnerable Chrome build. The attack vector is network-based and requires user interaction, such as visiting a malicious page or an advertisement iframe on a compromised site. No authentication is required. Because the resulting code execution is contained by the V8 sandbox, real-world impact typically requires chaining with a separate sandbox escape.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-82072

Indicators of Compromise

Chrome browser processes launching unexpected child processes such as command shells, script interpreters, or LOLBins immediately after web browsing activity.
Unexplained Chrome renderer crashes or repeated V8 engine faults recorded in crash telemetry, which can indicate exploitation attempts.
Outbound connections from chrome.exe to newly registered domains or low-reputation hosts serving JavaScript-heavy payloads.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any host running a build older than 151.0.7922.72.
Hunt for exploitation chains by correlating renderer process crashes with subsequent process creation, file writes to user-writable paths, or persistence changes.
Monitor proxy and DNS logs for browsing sessions that immediately precede endpoint alerts, to identify malicious HTML delivery pages.

Monitoring Recommendations

Ingest Chrome crash reports and browser telemetry into a centralized logging platform for anomaly review.
Track EDR process-lineage events where the parent is a Chrome renderer and the child is an unexpected binary.
Watch for privilege escalation or credential-access behavior following browser activity, which may indicate a sandbox escape chained with CVE-2026-82072.

How to Mitigate CVE-2026-82072

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update completes to ensure the patched V8 binary is loaded across all renderer processes.
Audit Chromium-based browsers and embedded browser components for downstream patch availability and apply updates.

Patch Information

Google released the fix in the Stable channel update announced on the Chrome Releases blog. The corresponding upstream tracking entry is Chromium Issue #534416978. Enterprise administrators should confirm rollout via Chrome Browser Cloud Management or existing software deployment tooling and verify that the version string reports 151.0.7922.72 or higher under chrome://settings/help.

Workarounds

No official workaround exists; patching is the only supported remediation path.
Restrict browsing to trusted sites and enforce enterprise policies that block unknown ad networks until patch deployment completes.
Consider temporarily disabling the V8 optimizer or JIT via the --jitless flag on high-risk workstations, understanding the performance and compatibility trade-offs.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: check installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enterprise policy example (Windows) to force update channel to Stable
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f