security
CVE-2026-102299: Type confusion in Chrome's V8 JavaScript engine
I reported a wrong number from V8. Chrome published it as type confusion, rated it High, and fixed it in Chrome 154.
- severity
- High
- component
- Type confusion in V8 (Turboshaft)
- reported
- Google Chrome VRP,
- status
- fixed in Chrome 154.0.8037.92 (stable)
- write-up
- generic pass
Chrome release, 154.0.8037.92 stable ↗ Chromium bug 556908674 ↗ Chrome severity guidelines ↗ NVD record ↗
In September 2026, I found a JavaScript function in Chrome that returned a number. When it was called a few times, the number returned was, of course, correct. But when I called the function enough times, V8 compiled it to a faster version. To my surprise, this faster version returned the wrong number!
Chrome classified it as a High-severity type confusion vulnerability in V8 and shipped the fix in Chrome 154.0.8037.92 on September 29:
Timeline#
- 2026-09-03: reported to the Chrome VRP (Chromium issue 556908674; Google’s advisory stamps it the 4th, UTC)
- 2026-09-17: fix landed in V8
- 2026-09-22: merged back to the Chrome 152, 153, 154 and 155 branches
- 2026-09-28: merged back to 150; CVE-2026-102299 assigned
- 2026-09-29: Chrome 154.0.8037.92 to stable; the advisory publishes, rated High
- 2026-09-29: NVD record published