CVE-2026-1862
Published: 03 February 2026
Summary
CVE-2026-1862 is a high-severity Type Confusion (CWE-843) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 19.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely identification, reporting, and patching of software flaws like the V8 type confusion vulnerability in Chrome prior to version 144.0.7559.132.
Implements memory protection mechanisms such as ASLR and DEP that mitigate heap corruption exploitation resulting from the type confusion vulnerability.
Enables ongoing vulnerability scanning to identify systems running vulnerable Chrome versions affected by CVE-2026-1862.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Type confusion in V8 enables RCE via malicious webpage (drive-by) and client-side exploitation.
NVD Description
Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-1862 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine within Google Chrome versions prior to 144.0.7559.132. Published on 2026-02-03, it enables potential heap corruption when processing a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High severity by Chromium security.
A remote attacker without privileges can exploit this vulnerability by tricking a user into visiting a malicious website with the crafted HTML page, requiring user interaction such as clicking a link. Successful exploitation could lead to high confidentiality, integrity, and availability impacts, potentially allowing heap corruption and arbitrary code execution in the context of the browser.
Google addressed the vulnerability in Chrome stable channel update 144.0.7559.132, as detailed in the Chrome Releases blog (https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop.html), Chromium issue tracker (https://issues.chromium.org/issues/479726070), and Microsoft's Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-1862). Users should apply the patch promptly to mitigate risk.
Details
- CWE(s)