CVE-2026-1220: Race in V8 in Google Chrome prior to 144

Synopsis

A race condition in V8, the JavaScript engine embedded in Google Chrome, allows a remote attacker to trigger type confusion by serving a crafted HTML page to a victim. The vulnerability is reachable over the network but requires the victim to visit a malicious page, and exploitation involves timing-dependent conditions that add complexity. Successful exploitation gives an attacker full read access, write access, and the ability to crash or destabilize the affected browser process, effectively enabling remote code execution in the renderer context. A patched-image rebuild at version 144.0.7559.99 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by getting them to load a remotely hosted crafted HTML page.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to visit a page under the attacker's control.

• Victim interactionRequired

  The victim must actively open or be redirected to a crafted HTML page, making social engineering or malvertising the primary delivery vector.

• Attack complexityDetail

  Exploitation is timing-dependent, relying on a race condition inside V8 that requires the attacker to win a narrow execution window, making reliable exploitation harder but not impossible with repeated attempts.

Blast Radius

• A successful exploit reads browser memory, exposing session tokens, credentials, and other sensitive data held in the renderer process.
• The attacker gains write primitives within the renderer, allowing modification of in-memory objects and enabling further exploitation steps such as sandbox escape.
• The browser process can be crashed outright, causing a denial of service for the affected user session.
• Combined high confidentiality, integrity, and availability impact means a fully weaponized exploit effectively achieves remote code execution in the Chrome renderer context.