CVE-2026-0902
Published: 20 January 2026
Description
Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and remediation of flaws such as the V8 out-of-bounds memory read vulnerability via patching to Chrome 144.0.7559.59 or later.
Implements memory protection mechanisms like ASLR and DEP to mitigate out-of-bounds memory read exploits in the V8 JavaScript engine.
Enforces process isolation in browsers like Chrome to contain exploitation of V8 flaws within renderer processes, limiting system-wide damage.
Security SummaryAI
CVE-2026-0902 stems from an inappropriate implementation in the V8 JavaScript engine within Google Chrome versions prior to 144.0.7559.59. This flaw allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. The vulnerability is associated with CWE-474 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with Chromium assigning it a Medium security severity.
A remote attacker can exploit this issue without requiring privileges by luring a user to interact with a malicious site, such as by visiting a crafted HTML page. Exploitation leads to high impacts on confidentiality, integrity, and availability, enabling potential memory corruption that could disclose sensitive data or facilitate further compromise.
Mitigation is available through the stable channel update for Chrome desktop, detailed in the Chrome Releases blog post and the associated Chromium issue tracker. Affected users should update to Google Chrome 144.0.7559.59 or later to address the vulnerability.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an out-of-bounds memory read in the V8 JavaScript engine exploited via a crafted HTML page in Chrome, directly enabling Exploitation for Client Execution (T1203).