CVE-2026-0899
Published: 20 January 2026
Summary
CVE-2026-0899 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 29.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-0899 is an out-of-bounds memory access vulnerability in the V8 JavaScript and WebAssembly engine within Google Chrome versions prior to 144.0.7559.59. This flaw, associated with CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write), enables a remote attacker to potentially cause object corruption through a specially crafted HTML page. Chromium rates the issue as High severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or interacting with a crafted HTML page, requiring no special privileges. Successful exploitation could lead to high-impact confidentiality, integrity, and availability violations, such as arbitrary code execution or sandbox escape via object corruption in the V8 engine.
Mitigation is available through the Google Chrome Stable Channel update for desktop, which patches the issue in version 144.0.7559.59 and later; details are provided in the Chrome Releases blog at https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_13.html and the Chromium issue tracker at https://issues.chromium.org/issues/458914193. Security practitioners should prioritize updating affected Chrome installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3449
Vulnerability details
Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
V8 OOB vuln in Chrome enables drive-by compromise via malicious HTML/JS page leading to client-side RCE or sandbox escape.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates identification, reporting, and timely remediation of flaws like the out-of-bounds memory access in Chrome's V8 engine via vendor patches.
Implements memory protection mechanisms such as ASLR, DEP, and stack canaries that directly mitigate out-of-bounds read/write exploits leading to object corruption.
Enforces process isolation via browser renderer sandboxes to limit the impact of V8 object corruption and potential sandbox escapes.