CVE-2026-0902
Published: 20 January 2026
Summary
CVE-2026-0902 is a high-severity Use of Function with Inconsistent Implementations (CWE-474) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 16.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-39 (Process Isolation).
Deeper analysis
CVE-2026-0902 stems from an inappropriate implementation in the V8 JavaScript engine within Google Chrome versions prior to 144.0.7559.59. This flaw allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. The vulnerability is associated with CWE-474 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with Chromium assigning it a Medium security severity.
A remote attacker can exploit this issue without requiring privileges by luring a user to interact with a malicious site, such as by visiting a crafted HTML page. Exploitation leads to high impacts on confidentiality, integrity, and availability, enabling potential memory corruption that could disclose sensitive data or facilitate further compromise.
Mitigation is available through the stable channel update for Chrome desktop, detailed in the Chrome Releases blog post and the associated Chromium issue tracker. Affected users should update to Google Chrome 144.0.7559.59 or later to address the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3453
Vulnerability details
Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an out-of-bounds memory read in the V8 JavaScript engine exploited via a crafted HTML page in Chrome, directly enabling Exploitation for Client Execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and remediation of flaws such as the V8 out-of-bounds memory read vulnerability via patching to Chrome 144.0.7559.59 or later.
Implements memory protection mechanisms like ASLR and DEP to mitigate out-of-bounds memory read exploits in the V8 JavaScript engine.
Enforces process isolation in browsers like Chrome to contain exploitation of V8 flaws within renderer processes, limiting system-wide damage.