CVE-2026-0902

Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML…

High · published January 20, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

⚡ A cunningly crafted HTML page can trick Chrome’s V8 engine into reading memory it shouldn't — and that’s no small feat! Think of it like a restaurant that serves a dish with an ingredient list that lets diners order from the entire pantry without restrictions. If the chef isn’t careful, customers can access far more than just their meal, potentially stirring up trouble in the kitchen! An attacker could exploit this vulnerability to read sensitive information stored in memory, opening the door to data leaks and unauthorized access. Imagine a thief peeking into secure storage and seeing everything inside—absolutely devastating for user privacy!

Put simply

Think of it like a restaurant that serves a dish with an ingredient list that lets diners order from the entire pantry without restrictions. If the chef isn’t careful, customers can access far more than just their meal, potentially stirring up trouble in the kitchen! This issue arises from an inappropriate implementation in the V8 engine, allowing out-of-bounds memory reads when processing certain crafted HTML pages. This means that a malicious page can force the browser to access memory areas it's not supposed to, leading to potential data exposure.

What to do

An attacker could exploit this vulnerability to read sensitive information stored in memory, opening the door to data leaks and unauthorized access. Imagine a thief peeking into secure storage and seeing everything inside—absolutely devastating for user privacy! Update Chrome to version 144.0.7559.59 or later immediately to close this vulnerability. Encourage users to avoid opening untrusted links or pages until they’ve patched their browsers. You've got this! Stay proactive and secure your browsing experience with that update! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Published
2026-01-20T04:14Z
EPSS history
Timeline
  • 20 JAN 04:14Z
    Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML…
    cvelistv5