Skip to content
Check Your Motor Oil Before Turbocharging: CVE-2026-7899, When V8's Optimization Engine Builds Up Carbon
nebusec.ai | research | CVE-2026-7899 | #ai-security | #bug-bounty | #rce | #browser-security | #exploit | #vulnerability | #cve | #javascript-security | #security-research | #v8 | #chrome | #webassembly | #cve-2026-7899 | #turboshaft
Summary
NebuSec details CVE-2026-7899: a Turboshaft Wasm load-elimination flaw where a stale replacement corrupts array lengths into fakeobj, yielding Chrome renderer RCE — a $55,000 Chrome VRP win.
Why it matters
This research reveals deep compiler-level optimization pitfalls in modern JIT/WASM engines that lead to renderer sandbox escapes.
- Vendor
- Product
- Chrome V8 JavaScript/WebAssembly engine
- CVSS
- 8.8
- Published
- Collected