Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (CVE-2026-87564)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 19% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Users and administrators should monitor official Google Chrome security advisories for updates and apply the official fix once it becomes available.
Description
A type confusion vulnerability in the V8 JavaScript engine of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to read memory inside the sandbox by delivering a crafted HTML page. This vulnerability is rated high severity by the Chromium security team. No CVSS score or patch information is currently available.
Impact
Successful exploitation allows a remote attacker to read memory inside the sandbox of the affected Chrome browser. This could potentially expose sensitive information contained in the browser's memory space. The vulnerability does not indicate code execution or sandbox escape, only memory disclosure.
Weaknesses
- CWE-843Access of Resource Using Incompatible Type ('Type Confusion') (opens in a new tab)
Base weakness
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.