CVE-2026-82072

Executive Summary

CVE-2026-82072 is an out-of-bounds read vulnerability in Google Chrome's V8 JavaScript engine, affecting Chrome versions prior to 151.0.7922.72. A remote attacker can exploit this flaw by luring a user to visit a crafted HTML page, potentially achieving arbitrary code execution inside the browser sandbox. With a CVSS score of 8.8 and no user interaction beyond visiting a webpage, this vulnerability poses a significant risk to all Chrome and Chromium-based browser users. The issue has been patched in Chrome 151.0.7922.72, with patch confirmation from two independent sources (NVD and Debian).

Technical Analysis

Vulnerability Class: CWE-125 — Out-of-bounds Read

This vulnerability resides in the V8 JavaScript engine component of Google Chrome. V8 is Google's open-source high-performance JavaScript and WebAssembly engine, responsible for compiling and executing JavaScript code within the browser. An out-of-bounds read in V8 means that during memory access operations — such as array indexing, typed array access, or object property reads — the engine fails to properly validate bounds before dereferencing a memory region.

Mechanism: The out-of-bounds read allows a remote attacker to read memory beyond the intended buffer boundaries. While the NVD description does not provide specific function names or code-level detail, the attack mechanism is well understood at the class level: JavaScript code delivered via a crafted HTML page triggers an operation that causes V8 to read past the end of an allocated buffer. This out-of-bounds read can leak sensitive memory contents, which is a critical primitive for constructing further memory corruption attacks.

Attack Surface: The attack surface is the V8 JavaScript engine, reachable through any web page that executes JavaScript. Since JavaScript execution is fundamental to modern web browsing, nearly every Chrome user is potentially exposed. The attack requires no special user privileges or authentication. User interaction is limited to visiting a malicious webpage (UI:R in the CVSS vector), which lowers the exploitation barrier significantly.

Impact Level: The NVD description states the vulnerability "allowed a remote attacker to execute arbitrary code inside the sandbox" — indicating that the out-of-bounds read, while itself a read primitive, can be chained with other V8 engine behaviors to achieve write primitives and eventually arbitrary code execution within Chrome's sandboxed renderer process. This is notable because V8 bugs of this nature are commonly exploited in real-world attack chains, often paired with a sandbox escape vulnerability to achieve full system compromise.

Patch Information: The fix is confirmed in Chrome version 151.0.7922.72 and later. Patch confidence is rated 3/4 (LIKELY), with confirmation from two independent sources: NVD and Debian. The vendor's own advisory reference is not available in the provided data, but Debian's security tracker independently confirms the patched version.

Exploitation Scenarios

Based strictly on the NVD description — "Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page" — the attack chain is inferred as follows:

Steps:

1. Reconnaissance/Target Identification: The attacker identifies targets running Chrome versions prior to 151.0.7922.72. This can be done via user-agent fingerprinting or by serving content that behaves differently across Chrome versions. Enterprise targets are typically identified through common browsing patterns or by distributing malicious links through phishing campaigns, watering-hole attacks on trusted websites, or malvertising.

2. Triggering the Flaw: The attacker crafts an HTML page containing JavaScript that triggers the out-of-bounds read in V8. The page is hosted on an attacker-controlled server. The user is induced to visit this page via social engineering (e.g., phishing email links) or by compromising a legitimate website. No additional user interaction beyond page load is required.

3. Payload/Execution Method: At the vulnerability-class level, the crafted JavaScript triggers a V8 operation that reads beyond an allocated buffer. This read primitive leaks memory contents, allowing the attacker to defeat Address Space Layout Randomization (ASLR) and gather heap layout information. The attacker then typically chains this information leak with a second memory corruption bug (or uses the leaked data to craft a follow-up write primitive) to achieve arbitrary code execution inside the Chrome sandbox. Note: The specific chain from read to code execution is not detailed in the NVD description and would depend on the exact engine state; typically this requires a subsequent write primitive or a separate bug to be fully exploited.

4. Post-Exploitation Impact: Upon achieving arbitrary code execution inside the sandbox, the attacker gains the ability to execute code with the privileges of the Chrome renderer process. This allows exfiltration of sensitive data accessible to the browser (cookies, autofill data, session tokens, page content), further memory corruption to escape the sandbox (leveraging a separate sandbox escape vulnerability), or deployment of browser-based persistence mechanisms.

Proof of Concept Intelligence

Why exploitation may still be possible:

1. V8 Exploitation is Well-Documented: V8 is one of the most scrutinized and exploited browser components. The exploitation techniques for out-of-bounds reads in V8 — heap spraying, pointer leaking, and JIT spraying — are well established and publicly documented in security research literature. Even without a public PoC for this specific CVE, skilled attackers can derive exploit techniques from the vulnerability class description.

2. Widespread Version Deployments: Despite the patch being available, enterprise environments and personal users with delayed update cycles remain vulnerable. Chrome's auto-update mechanism helps, but managed deployments can lag significantly.

3. Chromium Fork Fragmentation: The Debian patch confirmation indicates Chromium-based browsers (e.g., Brave, Edge, Opera) and various Electron-based applications are also affected, extending the attack surface beyond Google Chrome proper. These distributions may have separate update timelines, leaving systems exposed even after the Chrome patch is released.

Resources defenders should monitor for future PoC disclosure:

1. Exploit-DB (exploit-db.com) — popular for public exploit releases.
2. GitHub — researchers often publish PoC code in public repositories; monitor searches for "CVE-2026-82072."
3. Project Zero's issue tracker and Google's own security blog — Google frequently publishes detailed technical write-ups of V8 vulnerabilities they patch.
4. NVD and CVE feeds — for updates to the CVE entry, including any exploitation evidence.
5. Dark web and cybercrime forums — for early sales or distribution of exploit kits incorporating this CVE.

Impact Assessment

CVSS Analysis (Score: 8.8 — High):

• Attack Vector: Network (AV:N) — the vulnerability is remotely exploitable over the network.
• Attack Complexity: Low (AC:L) — no special conditions beyond delivering a malicious web page are required.
• Privileges Required: None (PR:N) — no authentication required.
• User Interaction: Required (UI:R) — the user must visit the crafted page, but this is a common and low-barrier condition.
• Confidentiality: High (C:H) — out-of-bounds read directly enables memory disclosure.
• Integrity: High (I:H) — arbitrary code execution allows data modification.
• Availability: High (A:H) — code execution can lead to browser crash or system compromise.

Affected Systems:

• Google Chrome versions prior to 151.0.7922.72 (all platforms — Windows, macOS, Linux).
• Chromium-based browsers that have not yet incorporated the upstream fix.
• The Debian patch confirmation implies Linux distributions packaging Chromium are affected until their packages are updated.

Business Impact:

• Data Exfiltration: Session tokens, credentials, corporate intranet content, and other browser-accessible data could be stolen.
• Lateral Movement: An attacker with code execution in the renderer may leverage corporate browser integrations, internal network access from the endpoint, or password managers to pivot into internal systems.
• Reputational Damage: A successful exploit chain targeting employee browsers can lead to significant organizational impact and regulatory scrutiny.
• Blast Radius: Given Chrome's ~65%+ browser market share, this vulnerability potentially affects a majority of internet users. In enterprise settings, essentially any employee actively browsing the web is a potential entry point.

Detection Guidance

The following detection rules target post-compromise and network-level indicators. Since the vulnerability is triggered client-side via JavaScript, pure network detection is challenging — most traffic will appear as normal HTTPS traffic. The rules below focus on detecting known exploitation artifacts, improbable behaviors, or indicators potentially observable at the host or network level.

Sigma Rule

title: Chrome V8 Out-of-Bounds Read Exploitation Attempt (CVE-2026-82072)
id: 6c9d89f0-9b2e-4d8a-9e76-9e9b0c8e3c1a
status: experimental
description: Detects potential exploitation of CVE-2026-82072 via Chrome crash artifacts indicating oversized memory reads or V8 engine assertion failures.
author: ValtersIT Threat Intelligence
date: 2026/04/22
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\chrome.exe'
        CommandLine|contains:
            - '--single-process'
            - '--no-sandbox'
    filter:
        CommandLine|contains:
            - '--type=renderer'
            - '--type=gpu-process'
    condition: selection and not filter
level: high
falsepositives:
    - Chrome launched with debugging flags for legitimate development/testing purposes
tags:
    - attack.execution
    - attack.t1203
    - cve.2026-82072

YARA Rule

rule CVE_2026_82072_V8_Exploit_Indicators {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects suspicious JavaScript patterns or memory dump artifacts associated with V8 out-of-bounds read exploitation"
        cve = "CVE-2026-82072"
        date = "2026-04-22"
        severity = "high"
    strings:
        // V8 typed array abuse patterns
        $s1 = "new ArrayBuffer(" ascii wide
        $s2 = "DataView(" ascii wide
        $s3 = "Float64Array" ascii wide
        $s4 = "addrof" ascii wide
        $s5 = "fakeobj" ascii wide
        // Heap spray patterns common to V8 exploitation
        $s6 = "0x41414141" ascii
        $s7 = "0123456789abcdef" ascii
        $h1 = "v8::internal::" ascii
        $h2 = "out of bounds" ascii wide
    condition:
        (uint16(0) == 0x5A4D and ($h1 or $h2) and 2 of ($s*)) or
        (filesize < 200KB and 4 of ($s*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-82072 Chrome V8 OOB Read Exploitation Attempt (Crafted HTML)"; flow:established,to_client; content:"<script"; nocase; pcre:"/(\x3cscript[\s\S]{0,5000})(ArrayBuffer|DataView|Float64Array|Uint8Array)/si"; classtype:attempted-user; sid:10082072; rev:1; metadata:cve CVE-2026-82072;)

Note: This rule flags HTTP traffic containing characteristic JavaScript constructs commonly used in V8 exploitation. Given that Chrome default traffic is HTTPS, this rule primarily detects downgraded or non-TLS traffic; for encrypted traffic, rely on host-based detection and browser logs.

Elastic Detection

// EQL query — detect Chrome processes with sandbox-disabled flags
sequence with maxspan=5m
  [ process where event.action == "start" and process.name == "chrome.exe"
    and process.args : ("--no-sandbox", "--single-process", "--disable-web-security")
    and process.args : ("--type=renderer") ]
  [ file where event.action == "modification" and process.name == "chrome.exe"
    and file.extension == "dmp" ]

Splunk SPL Query

index=windows EventCode=4688
| where ProcessName="*\\chrome.exe"
| search CommandLine="*--no-sandbox*" OR CommandLine="*--single-process*" OR CommandLine="*--disable-web-security*"
| table _time, User, CommandLine, ParentProcessName
| eval CVE="CVE-2026-82072"
| stats count by User, CommandLine, ParentProcessName

Wazuh OSSEC Rule

<group name="chrome,">
  <rule id="100272" level="12">
    <decoded_as>syslog</decoded_as>
    <program_name>chrome</program_name>
    <match>--no-sandbox|--single-process|--disable-web-security</match>
    <description>CVE-2026-82072: Chrome launched with sandbox-disabling flags (potential V8 exploit)</description>
    <group>pci_dss_11.4,hids,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — confirmed by NVD and Debian as fixed in Chrome 151.0.7922.72.

1. Immediate Mitigations:

• Apply the stable channel update immediately: Ensure all Chrome installations are upgraded to version 151.0.7922.72 or later. Chrome's auto-update will handle this for most users, but administrators should force-update managed endpoints.
• Harden browsing policies: If immediate update is not possible, enforce restrictive web content policies — block JavaScript execution from untrusted domains, disable WebAssembly if not needed, and consider using a URL-filtering proxy to block known malicious sites.
• Restrict Chrome extensions: Disable unnecessary extensions, as compromised extensions could be leveraged to inject the malicious page or amplify the exploit.
• Update all Chromium-based browsers: Edge, Brave, Opera, and Electron-based applications (Slack, Discord, VS Code, etc.) must be updated to versions incorporating the V8 fix. The Debian patch confirms Linux distributions are also affected.

2. Patch/Upgrade Steps:

• Chrome: Navigate to chrome://settings/help to trigger the update check; or deploy via enterprise policy: GoogleUpdate policy to enforce auto-update.
• Linux/Debian: sudo apt update && sudo apt upgrade chromium (or chromium-browser).
• Electron apps: Update to versions based on Electron that includes Chrome 151+ or the specific backported V8 fix.
• Enterprise deployment: Use Chrome Enterprise Browser Management or GPO/plist policies to force a specific minimum version across the fleet.

3. Long-Term Hardening:

• Enforce Site Isolation: Enable Site Isolation (default in Chrome for most configurations) to limit the blast radius of renderer compromise.
• Enable Chrome's security features: Ensure Safe Browsing, predictive phishing protection, and enhanced protection mode are enabled.
• Adopt ZTA principles: Treat browsers as high-risk endpoints — assume compromise and monitor WebSocket/HTTP connections from endpoints for exfiltration patterns.
• Patch management discipline: Maintain a rapid patch SLA (≤72 hours) for browser vulnerabilities given their criticality.
• Network segmentation: Restrict browser-bearing endpoints from accessing high-value internal systems directly.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82072
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-82072 (confirms patched version)
3. Google Chrome Releases Blog: https://chromereleases.googleblog.com/ (track for official advisory and release notes for version 151.0.7922.72)
4. CWE-125 (Out-of-bounds Read): https://cwe.mitre.org/data/definitions/125.html
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (Not listed as of this report; monitor for potential additions)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of the data available, this CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public PoC, exploit code, or Nuclei template exists. No specific threat actor campaigns have been publicly attributed to this CVE. However, given the history of V8 vulnerabilities being actively exploited in-the-wild shortly after disclosure, continued monitoring of the KEV catalog and vendor advisories is strongly recommended.