CVE-2026-84326: Google Chrome V8 RCE Vulnerability

CVE-2026-84326 is a remote code execution vulnerability in Google Chrome V8 engine caused by an uninitialized resource. Attackers can exploit this flaw via crafted HTML pages to execute arbitrary code within the sandbox. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-84326 Overview

CVE-2026-84326 is an uninitialized resource vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.75. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. Google Chromium rates the security severity as High. The weakness is classified under [CWE-908: Use of Uninitialized Resource].

Critical Impact
Successful exploitation permits arbitrary code execution inside the Chrome renderer sandbox through a single crafted web page, enabling drive-by compromise of user sessions.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.75
Chromium-based browsers embedding the affected V8 engine build
Applications shipping the vulnerable V8 component

Discovery Timeline

2026-09-02 - CVE-2026-84326 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84326

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. V8 fails to initialize a resource before use, leaving memory contents in an undefined state. An attacker who controls JavaScript execution can influence the uninitialized values to steer engine behavior. This typically results in type confusion, corrupted object metadata, or leaked pointers usable for further exploitation. The Chromium project tracks the underlying issue in Chromium Issue Report #547936520.

Root Cause

The root cause is an uninitialized resource condition [CWE-908] in V8. A code path allocates or references memory without first assigning a defined value. Subsequent reads consume attacker-influenceable data as if it were trusted engine state. In JIT-compiled JavaScript engines, this class of flaw often collapses into a memory safety violation that grants control over object shapes or code pointers.

Attack Vector

Exploitation requires only that a user load an attacker-controlled HTML page in a vulnerable Chrome build. No credentials are needed, and the attack traverses the network. User interaction is limited to opening or being redirected to the malicious page. Delivery vectors include phishing links, malvertising, watering-hole compromises, and embedded iframes on otherwise trusted sites. Arbitrary code executes inside the renderer sandbox, which an attacker may chain with a sandbox escape to achieve host compromise.

No public proof-of-concept is currently available. See the Chrome Releases Update Announcement for vendor context.

Detection Methods for CVE-2026-84326

Indicators of Compromise

Chrome renderer processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters
Outbound connections from Chrome to newly registered or low-reputation domains immediately after page loads
Crash dumps referencing V8 frames with uninitialized memory reads or type confusion signatures
Browser telemetry showing installed Chrome versions below 152.0.7977.75

Detection Strategies

Inventory endpoint Chrome versions and flag any host running builds earlier than 152.0.7977.75
Alert on anomalous process lineage where chrome.exe renderer processes create scripting hosts or download binaries
Correlate browser crash events with subsequent network beacons or persistence artifacts
Deploy behavioral analytics that treat renderer-originated code execution as high severity

Monitoring Recommendations

Ingest browser process telemetry and DNS logs into a centralized data lake for correlation
Track patch compliance metrics for Chrome and Chromium-based browsers across the fleet
Monitor for exploit kit signatures targeting V8 in web and email gateway logs

How to Mitigate CVE-2026-84326

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all managed endpoints
Force-restart Chrome sessions after deployment so patched binaries load into memory
Audit Chromium-based browsers and embedded WebView components for the fixed V8 build
Restrict execution of untrusted HTML content in high-risk user groups until patching completes

Patch Information

Google addressed the vulnerability in Chrome Stable channel 152.0.7977.75. Details are published in the Chrome Releases Update Announcement. Enterprise administrators should push the update through Chrome Browser Cloud Management, Group Policy, or their standard software distribution tooling.

Workarounds

Disable the V8 JIT compiler where feasible using the --js-flags="--jitless" startup option to reduce the exploitable surface
Enforce Site Isolation and Enhanced Safe Browsing across managed Chrome deployments
Block or sandbox access to unclassified web content through secure web gateways until patches are applied

bash

# Verify Chrome version on Windows endpoints via registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify Chrome version on Linux/macOS
google-chrome --version

# Enterprise policy example (Windows Group Policy): enforce minimum version via auto-update
# HKLM\SOFTWARE\Policies\Google\Update\TargetVersionPrefix{8A69D345-D564-463C-AFF1-A69D9E530F96} = 152.0.7977.75