CVE-2026-2649
Published: 18 February 2026
Summary
CVE-2026-2649 is a high-severity External Control of Assumed-Immutable Web Parameter (CWE-472) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 46.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-39 (Process Isolation).
Deeper analysis
CVE-2026-2649 is an integer overflow vulnerability (CWE-472) in the V8 JavaScript and WebAssembly engine within Google Chrome versions prior to 145.0.7632.109. The flaw allows potential heap corruption when processing a crafted HTML page, as reported with a Chromium security severity rating of High. The vulnerability received a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), highlighting its high impact on confidentiality, integrity, and availability.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or opening a crafted HTML page. No privileges are required on the target system, and exploitation relies on low complexity with user interaction, such as loading the page in an affected browser instance. Successful exploitation could enable heap corruption, potentially leading to arbitrary code execution or other severe impacts within the browser's sandboxed environment.
Mitigation is addressed in the stable channel update for Google Chrome desktop, detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_18.html, which backports the fix to version 145.0.7632.109. Additional technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/481074858. Security practitioners should prioritize updating affected Chrome installations to the patched version.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7940
Vulnerability details
Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow in Chrome V8 enables RCE via crafted webpage visit, directly mapping to drive-by compromise (T1189) and client-side exploitation for execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the V8 integer overflow flaw through patching Chrome to version 145.0.7632.109, eliminating the vulnerability.
Implements memory protections such as DEP and ASLR to mitigate heap corruption exploitation from the integer overflow in V8.
Enforces process isolation via browser sandboxing to contain heap corruption in V8 renderer processes, preventing escape to the system.