V8 (Google) - vulnerabilities (CVEs)

36 CVEs, 0 in the last 30 days, 1222 known versions, newest CVE from 2026-09-03. Vendor: Google.

CVEs of V8

CVE-2026-85046 - CVSS 8.8 (high), 2026-09-03: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…
CVE-2024-3914 - CVSS 8.8 (high), 2024-04-17: Use after free in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-1939 - CVSS 8.8 (high), 2024-02-29: Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2016-5129 - CVSS 8.8 (high), 2016-07-23: Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to…
CVE-2016-5128 - CVSS 8.8 (high), 2016-07-23: objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target…
CVE-2016-1688 - CVSS 6.5 (medium), 2016-06-05: The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string…
CVE-2016-1678 - CVSS 8.8 (high), 2016-06-05: objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote…
CVE-2016-1677 - CVSS 6.5 (medium), 2016-06-05: uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain…
CVE-2016-1669 - CVSS 8.8 (high), 2016-05-14: The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand…
CVE-2016-3679 - CVSS 8.8 (high), 2016-03-29: Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allow attackers to cause a denial of…
CVE-2016-2843 - CVSS 9.8 (critical), 2016-03-06: Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow attackers to cause a denial of…
CVE-2015-8548 - CVSS 10 (critical), 2015-12-14: Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.80, allow attackers to cause a denial of service…
CVE-2015-8478 - CVSS 7.5 (high), 2015-12-06: Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.73, allow attackers to cause a denial of service…
CVE-2015-7834 - CVSS 7.5 (high), 2015-10-15: Multiple unspecified vulnerabilities in Google V8 before 4.6.85.23, as used in Google Chrome before 46.0.2490.71, allow attackers to cause a denial of service…
CVE-2015-6580 - CVSS 7.5 (high), 2015-09-03: Multiple unspecified vulnerabilities in Google V8 before 4.5.103.29, as used in Google Chrome before 45.0.2454.85, allow attackers to cause a denial of…
CVE-2015-5380 - CVSS 7.5 (high), 2015-07-09: The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3,…
CVE-2015-3910 - CVSS 7.5 (high), 2015-05-20: Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service…
CVE-2015-3333 - CVSS 7.5 (high), 2015-04-19: Multiple unspecified vulnerabilities in Google V8 before 4.2.77.14, as used in Google Chrome before 42.0.2311.90, allow attackers to cause a denial of service…
CVE-2015-1242 - CVSS 7.5 (high), 2015-04-19: The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8, as used in Google Chrome before 42.0.2311.90, allows…
CVE-2015-2238 - CVSS 7.5 (high), 2015-03-09: Multiple unspecified vulnerabilities in Google V8 before 4.1.0.21, as used in Google Chrome before 41.0.2272.76, allow attackers to cause a denial of service…
CVE-2015-1346 - CVSS 7.5 (high), 2015-01-22: Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of…
CVE-2014-7967 - CVSS 7.5 (high), 2014-10-08: Multiple unspecified vulnerabilities in Google V8 before 3.28.71.15, as used in Google Chrome before 38.0.2125.101, allow attackers to cause a denial of…
CVE-2014-3152 - CVSS 7.5 (high), 2014-05-21: Integer underflow in the LCodeGen::PrepareKeyedOperand function in arm/lithium-codegen-arm.cc in Google V8 before 3.25.28.16, as used in Google Chrome before…
CVE-2014-1704 - CVSS 10 (critical), 2014-03-16: Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial of…
CVE-2013-6668 - CVSS 7.5 (high), 2014-03-05: Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Google Chrome before 33.0.1750.146, allow attackers to cause a denial of…
CVE-2013-6639 - CVSS 7.5 (high), 2013-12-07: The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows…
CVE-2013-6640 - CVSS 7.5 (high), 2013-12-07: The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows…
CVE-2013-6638 - CVSS 7.5 (high), 2013-12-07: Multiple buffer overflows in runtime.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allow remote attackers to cause a denial…
CVE-2013-2838 - CVSS 5 (medium), 2013-05-22: Google V8, as used in Google Chrome before 27.0.1453.93, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2013-2632 - CVSS 6.8 (medium), 2013-03-21: Google V8 before 3.17.13, as used in Google Chrome before 27.0.1444.3, allows remote attackers to cause a denial of service (application crash) or possibly…
CVE-2013-0836 - CVSS 6.8 (medium), 2013-01-15: Google V8 before 3.14.5.3, as used in Google Chrome before 24.0.1312.52, does not properly implement garbage collection, which allows remote attackers to…
CVE-2012-5128 - CVSS 7.5 (high), 2012-11-07: Google V8 before 3.13.7.5, as used in Google Chrome before 23.0.1271.64, does not properly perform write operations, which allows remote attackers to cause a…
CVE-2012-5120 - CVSS 7.5 (high), 2012-11-07: Google V8 before 3.13.7.5, as used in Google Chrome before 23.0.1271.64, on 64-bit Linux platforms allows remote attackers to cause a denial of service or…
CVE-2011-5037 - CVSS 5 (medium), 2011-12-30: Google V8 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to…
CVE-2011-3886 - CVSS 6.8 (medium), 2011-10-25: Google V8, as used in Google Chrome before 15.0.874.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via…
CVE-2009-2555 - CVSS 9.3 (critical), 2009-07-21: Heap-based buffer overflow in src/jsregexp.cc in Google V8 before 1.1.10.14, as used in Google Chrome before 2.0.172.37, allows remote attackers to execute…