{"id":"CVE-2026-126880","kind":"vulnerability","aliases":["CVE-2026-126880"],"related":[],"title":"Chrome: V8 type confusion lets a crafted web page run code","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"A type confusion bug in the V8 JavaScript engine of Google Chrome versions before 157.0.8103.78 lets a remote attacker run arbitrary code inside the browser sandbox. The attack works through a crafted HTML page that a victim opens.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","chrome","endpoints","other"],"not_affected_if":["chrome-up-to-date"],"how_to_check":"- Open Chrome and check the version under Settings > About Chrome; it should read `157.0.8103.78` or later.\n- Check the installed version on managed machines with `google-chrome --version` on Linux.","fix":"- Google Chrome: move to `157.0.8103.78` or later.","status":"open","published_at":"2026-11-11T23:17:17+00:00","first_seen_at":"2026-11-11T23:29:38+00:00","triaged_at":"2026-11-11T23:32:15+00:00","updated_at":"2026-11-11T23:32:15+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T23:32:15Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.78` or later.","reach":"internet","title":"Chrome: V8 type confusion lets a crafted web page run code","impact":"high","summary":"A type confusion bug in the V8 JavaScript engine of Google Chrome versions before 157.0.8103.78 lets a remote attacker run arbitrary code inside the browser sandbox. The attack works through a crafted HTML page that a victim opens.","audience":"everyone","category":"other","nicknames":[],"who_cares":["chrome","browsers","endpoints"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote code runs inside the browser sandbox on the victim's device.","analyst_note":"","how_to_check":"- Open Chrome and check the version under Settings > About Chrome; it should read `157.0.8103.78` or later.\n- Check the installed version on managed machines with `google-chrome --version` on Linux.","plain_action":"Update Google Chrome to version 157.0.8103.78 or later: open the menu, go to Settings > About Chrome, and let it restart.","product_name":"","needs_analyst":false,"not_affected_if":["chrome-up-to-date"],"who_is_affected":"Any device running Google Chrome before 157.0.8103.78 is exposed when the user visits an attacker-controlled page. Managed fleets should confirm the version across endpoints. unknown for other Chromium-based browsers, which depend on their own builds.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4531,"output_tokens":548,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126880':14A,17A '-2026':13A,16A '157.0.8103.78':35B,68C 'allow':69C 'arbitrari':41B,75C 'attack':39B,48B,72C 'browser':18B,45B 'bug':24B 'chrome':1A,19B,32B,65C 'chromium':85C 'code':11A,42B,76C 'confus':4A,23B,60C 'craft':7A,52B,82C 'cve':12A,15A 'endpoint':20B 'engin':29B 'execut':74C 'googl':31B,64C 'high':88C 'html':53B,83C 'insid':43B,77C 'javascript':28B 'let':5A,36B 'open':58B 'page':9A,54B,84C 'prior':66C 'remot':38B,71C 'run':10A,40B 'sandbox':46B,79C 'secur':86C 'sever':87C 'type':3A,22B,59C 'v8':2A,27B,62C 'version':33B 'via':80C 'victim':57B 'web':8A 'work':49B","nicknames":[],"mitigations":[],"who_affected":"Any device running Google Chrome before 157.0.8103.78 is exposed when the user visits an attacker-controlled page. Managed fleets should confirm the version across endpoints. unknown for other Chromium-based browsers, which depend on their own builds.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.78 or later: open the menu, go to Settings > About Chrome, and let it restart.","pkeys":[],"ptokens":[],"labels":["browsers","chrome","endpoints","high","other"],"campaign_type":null,"search_a":"'-126880':14A,17A '-2026':13A,16A 'chrome':1A 'code':11A 'confus':4A 'craft':7A 'cve':12A,15A 'let':5A 'page':9A 'run':10A 'type':3A 'v8':2A 'web':8A","search_b":"'157.0.8103.78':35B 'arbitrari':41B 'attack':39B,48B 'browser':18B,45B 'bug':24B 'chrome':19B,32B 'code':42B 'confus':23B 'craft':52B 'endpoint':20B 'engin':29B 'googl':31B 'html':53B 'insid':43B 'javascript':28B 'let':36B 'open':58B 'page':54B 'remot':38B 'run':40B 'sandbox':46B 'type':22B 'v8':27B 'version':33B 'victim':57B 'work':49B","search_c":"'157.0.8103.78':68C 'allow':69C 'arbitrari':75C 'attack':72C 'chrome':65C 'chromium':85C 'code':76C 'confus':60C 'craft':82C 'execut':74C 'googl':64C 'high':88C 'html':83C 'insid':77C 'page':84C 'prior':66C 'remot':71C 'sandbox':79C 'secur':86C 'sever':87C 'type':59C 'v8':62C 'via':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126880","severity":null,"published_at":"2026-11-11T23:17:17+00:00","modified_at":"2026-11-11T23:17:17+00:00","first_seen_at":"2026-11-11T23:29:38+00:00","fetched_at":"2026-11-11T23:29:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}