CVE-2026-0902
Google Chrome ≤ 144.0.7559.59
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2026-0902 is a high-severity Use of Function with Inconsistent Implementations (CWE-474) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-0902 stems from an inappropriate implementation in the V8 JavaScript engine within Google Chrome versions prior to 144.0.7559.59. This flaw allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. The vulnerability is associated with CWE-474 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with Chromium assigning it a Medium security severity.
A remote attacker can exploit this issue without requiring privileges by luring a user to interact with a malicious site, such as by visiting a crafted HTML page. Exploitation leads to high impacts on confidentiality, integrity, and availability, enabling potential memory corruption that could disclose sensitive data or facilitate further compromise.
Mitigation is available through the stable channel update for Chrome desktop, detailed in the Chrome Releases blog post and the associated Chromium issue tracker. Affected users should update to Google Chrome 144.0.7559.59 or later to address the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3453
Vulnerability Data
Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing across OS versions can reveal behavioral differences caused by the inconsistent function.
Documented development standards and tools can prohibit or replace functions known to have inconsistent implementations.
Engineering principles can require use of portable, consistently implemented functions across platforms.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce coding standards and portability reviews that avoid functions with inconsistent behavior across platforms.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can surface cross-platform inconsistencies but does not prevent their introduction in code.
Secure SDLC requires consistent API selection and platform abstraction, reducing use of inconsistently implemented functions.
Secure architecture principles include portable abstractions and avoiding platform-specific calls with divergent behavior.
Secure coding standards explicitly prohibit or wrap functions known to behave differently across OSes and versions.