Google V8: vulnerabilidades y CVE
Google V8 tiene 34 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 1 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE34
Últimos 12 meses1
Críticas1
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-85046 | Alta (8.8) | 49% | ⚠ Explotación activa | 3 sept 2026 | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-85046 | Alta (8.8) | 49% | ⚠ Explotación activa | 3 sept 2026 | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2016-5129 | Alta (8.8) | 2.1% | — | 23 jul 2016 | Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to cause a denial of service (memory corruption) or possibly have… |
| CVE-2016-5128 | Alta (8.8) | 1.3% | — | 23 jul 2016 | objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to… |
| CVE-2016-1688 | Media (6.5) | 2.1% | — | 5 jun 2016 | The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string sizes, which allows remote attackers to cause a denial of… |
| CVE-2016-1678 | Alta (8.8) | 1.6% | — | 5 jun 2016 | objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service (heap-based buffer… |
| CVE-2016-1677 | Media (6.5) | 3.1% | — | 5 jun 2016 | uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and… |
| CVE-2016-1669 | Alta (8.8) | 4.2% | — | 14 may 2016 | The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to… |
| CVE-2016-3679 | Alta (8.8) | 1.2% | — | 29 mar 2016 | Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2016-2843 | Crítica (9.8) | 1.1% | — | 6 mar 2016 | Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2015-8548 | Alta (10) | 1.2% | — | 14 dic 2015 | Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.80, allow attackers to cause a denial of service or possibly have other impact via unknown vectors, a… |
| CVE-2015-8478 | Alta (7.5) | 0.63% | — | 6 dic 2015 | Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.73, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2015-7834 | Alta (7.5) | 0.88% | — | 15 oct 2015 | Multiple unspecified vulnerabilities in Google V8 before 4.6.85.23, as used in Google Chrome before 46.0.2490.71, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2015-6580 | Alta (7.5) | 0.63% | — | 3 sept 2015 | Multiple unspecified vulnerabilities in Google V8 before 4.5.103.29, as used in Google Chrome before 45.0.2454.85, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2015-5380 | Alta (7.5) | 3.0% | — | 9 jul 2015 | The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory… |
| CVE-2015-3910 | Alta (7.5) | 0.89% | — | 20 may 2015 | Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2015-3333 | Alta (7.5) | 0.94% | — | 19 abr 2015 | Multiple unspecified vulnerabilities in Google V8 before 4.2.77.14, as used in Google Chrome before 42.0.2311.90, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2015-1242 | Alta (7.5) | 3.0% | — | 19 abr 2015 | The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service or possibly… |
| CVE-2015-2238 | Alta (7.5) | 0.64% | — | 9 mar 2015 | Multiple unspecified vulnerabilities in Google V8 before 4.1.0.21, as used in Google Chrome before 41.0.2272.76, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2015-1346 | Alta (7.5) | 1.2% | — | 22 ene 2015 | Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2014-7967 | Alta (7.5) | 0.59% | — | 8 oct 2014 | Multiple unspecified vulnerabilities in Google V8 before 3.28.71.15, as used in Google Chrome before 38.0.2125.101, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2014-3152 | Alta (7.5) | 2.0% | — | 21 may 2014 | Integer underflow in the LCodeGen::PrepareKeyedOperand function in arm/lithium-codegen-arm.cc in Google V8 before 3.25.28.16, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of… |
| CVE-2014-1704 | Alta (10) | 1.5% | — | 16 mar 2014 | Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2013-6668 | Alta (7.5) | 5.7% | — | 5 mar 2014 | Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Google Chrome before 33.0.1750.146, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
| CVE-2013-6640 | Alta (7.5) | 1.8% | — | 7 dic 2013 | The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds… |
| CVE-2013-6639 | Alta (7.5) | 1.8% | — | 7 dic 2013 | The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds… |
| CVE-2013-6638 | Alta (7.5) | 1.9% | — | 7 dic 2013 | Multiple buffer overflows in runtime.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allow remote attackers to cause a denial of service or possibly have unspecified other impact via… |
| CVE-2013-2838 | Media (5) | 1.5% | — | 22 may 2013 | Google V8, as used in Google Chrome before 27.0.1453.93, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. |
| CVE-2013-2632 | Media (6.8) | 1.1% | — | 21 mar 2013 | Google V8 before 3.17.13, as used in Google Chrome before 27.0.1444.3, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code, as… |
| CVE-2013-0836 | Media (6.8) | 1.0% | — | 15 ene 2013 | Google V8 before 3.14.5.3, as used in Google Chrome before 24.0.1312.52, does not properly implement garbage collection, which allows remote attackers to cause a denial of service (application crash) or possibly have… |
| CVE-2012-5128 | Alta (7.5) | 1.3% | — | 7 nov 2012 | Google V8 before 3.13.7.5, as used in Google Chrome before 23.0.1271.64, does not properly perform write operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact… |