Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-09-06 | 2 | Disclosure2 |
| 2026-09-14 | 1 | PoC1 |
Exploiting CVE-2026-19174: integer overflow in V8 WebAssembly https://qedaudit.io/blog/brilliantly-simple/ Credits @0x10n #infosec https://t.co/jBwKJThIAm
Post summary
The tweet shares a link to a blog post detailing the exploitation of CVE-2026-19174, an integer overflow in V8 WebAssembly, classifying it as a PoC disclosure.
@QED_Audit found CVE-2026-19174, an integer overflow in V8 that gives you arbitrary code execution in Chrome. The bug is one line of constant arithmetic. It survived 3.5 years of fuzzing, manual audit, and LLM-driven review. (1/n) https://t.co/XWHTquO4iL
Post summary
QED_Audit has identified CVE‑2026‑19174, an integer overflow in Chrome’s V8 engine that enables arbitrary code execution, but no PoC or exploitation details are shared.
The bug, CVE-2026-19174, gives an attacker arbitrary code execution in the renderer. More importantly, it lets you corrupt **native JIT code space directly**, granting code execution without the V8 sandbox ever entering the picture. All because of this single line of code! (4/5) https://t.co/D5QWwu76n9
Post summary
The tweet announces CVE‑2026‑19174, describing how a single line of code can corrupt the V8 native JIT space to achieve arbitrary code execution in the renderer.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | chrome | - | - | - |