CVE-2026-1220: V8 Race Condition Type Confusion in Chrome – Patch Guidance

Technical summary

CVE-2026-1220 is a race condition (CWE-362) in the V8 JavaScript engine shipped with Google Chrome prior to version 144.0.7559.99. The vulnerability allows type confusion—a state where the engine misidentifies the actual type of an object in memory—through a timing-sensitive code path. An attacker exploits this by delivering a crafted HTML page that triggers concurrent execution patterns during garbage collection or object allocation, causing the type safety guarantees of the V8 engine to be violated. The race window is narrow and difficult to trigger reliably, which is reflected in the CVSS scoring (AC:H). Successful exploitation grants the attacker capabilities typically restricted by the browser sandbox.

Business impact

This vulnerability poses a moderate-to-significant risk to organizations whose workforces browse the web with Chrome. Exploitation could lead to data exfiltration from browser memory (which may contain session tokens, credentials, or sensitive web content), unauthorized modifications to web pages or cached data, or denial of service through targeted crashes. The requirement for user interaction (visiting a malicious site) limits the attack surface compared to wormable flaws, but phishing and drive-by download tactics remain viable delivery mechanisms. Any organization relying on Chrome's security model as a boundary for untrusted content should treat this as a priority remediation target.

Affected systems

Google Chrome is the primary affected product. The vulnerability is specific to Chrome's V8 engine implementation, though the underlying operating systems listed (macOS, Linux kernel, Windows) are relevant only insofar as Chrome runs on them. All Chrome installations on these platforms running version 143.0.7559.99 or earlier require patching. Other Chromium-based browsers (Edge, Opera, Brave, etc.) may be affected if they integrate the vulnerable V8 version; organizations should verify their specific Chromium-based browser versions against the Chrome stable release timeline.

Exploitability

Exploitability is constrained by several factors. The race condition requires precise timing and typically demands multiple page loads or extended user interaction with the malicious page to increase the probability of hitting the vulnerable code path. CVSS AC:H reflects this difficulty. The vulnerability requires user interaction (UI:R) and does not grant network access to arbitrary systems; it is confined to the bounds of the browser process. However, the attack surface is broad—any webpage the user visits, including those served via compromised ad networks or watering-hole attacks, could deliver the payload. No public exploitation techniques were available at the time of publication, but the high Chromium severity rating indicates the Chrome security team assessed the practical impact as significant.

Remediation

Upgrade Google Chrome to version 144.0.7559.99 or later. This patch addresses the race condition in V8. Users can verify their current Chrome version by navigating to chrome://settings/help, which will also prompt automatic updates if available. Organizations managing Chrome deployments via policy should update their deployment configurations to enforce version 144.0.7559.99 or later. For Chromium-based browsers not listed in the CVE, cross-reference their upstream Chromium version against the Chrome release notes to determine equivalency.

Patch guidance

Google Chrome auto-updates to stable releases, typically rolling out over several days. Manually trigger updates via chrome://settings/help or Settings > About Chrome. For enterprise environments: deploy version 144.0.7559.99 or later using your standard Chrome management tools (Google Admin Console, Intune, etc.). Verify patch application by spot-checking client chrome://version outputs. Prioritize user-facing systems and workstations that access sensitive web content or internal web applications. Test patch compatibility with critical browser extensions before broad rollout if your environment has custom web applications or security-sensitive plugins.

Detection guidance

Detection at the network level is limited, as the vulnerability resides within the browser process and does not manifest as anomalous network traffic. Monitor Chrome version compliance via endpoint management tools (Intune, Jamf, etc.) to identify unpatched installations. Monitor system logs on macOS, Linux, and Windows for unexpected Chrome process crashes or memory access violations, which may indicate attempted exploitation. Web application firewall (WAF) rules are unlikely to detect this attack, as the payload is embedded in HTML/JavaScript that passes normal content inspection. Focus detection efforts on version tracking and post-compromise forensics (reviewing browser cache, session history, and process memory dumps).

Why prioritize this

Despite the lack of active, widespread exploitation (KEV status: not listed), the combination of high CVSS severity, the need for only a single user interaction, and the prevalence of Chrome in enterprise environments warrants prioritization within a 30-day patch window. The race condition, while difficult to trigger, is deterministic and reproducible by a skilled attacker, and the impact (information disclosure and integrity violation) affects core browser security assumptions. Organizations should treat this as a mandatory update for any system where data confidentiality is a concern.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects: Network-accessible attack vector (AV:N), high attack complexity due to race condition timing (AC:H), no privilege requirement (PR:N), user interaction required (UI:R), and confidentiality, integrity, and availability impacts all possible within the browser's security context (C:H/I:H/A:H). The score appropriately penalizes AC:H to reflect the narrow exploitation window, preventing a Critical rating, while the multi-impact nature elevates severity above 7.0.

Frequently asked questions