CVE-2026-2649: 
vulnerability analysis and mitigation

CVE-2026-2649 is an integer overflow vulnerability in the V8 JavaScript engine of Google Chrome that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. It was reported by JunYoung Park (@candymate) of KAIST Hacking Lab on February 3, 2026, and publicly disclosed on February 18, 2026, when Google released Chrome 145.0.7632.109 (Chrome Advisory). Affected versions include all Google Chrome releases prior to 145.0.7632.109, as well as Microsoft Edge (Chromium-based) prior to the corresponding patched release (Microsoft MSRC). The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Feedly).

The root cause is an integer overflow (CWE-190 by nature, though Feedly maps it to CWE-472) in Chrome's V8 JavaScript engine, which can lead to heap memory corruption. When a user visits a specially crafted HTML page, the malicious JavaScript triggers an arithmetic overflow condition in V8's internal integer handling, causing it to write data outside the intended memory bounds. Exploitation requires user interaction — specifically, a victim must navigate to or be redirected to an attacker-controlled page — but no authentication or elevated privileges are needed on the attacker's side (Chrome Advisory). The bug was tracked internally as Chromium issue #481074858.

Successful exploitation could allow a remote attacker to achieve arbitrary code execution or cause a denial of service (browser crash) on the victim's system. The attacker would execute code with the same privileges as the Chrome browser process, potentially enabling access to sensitive data, session tokens, or local files accessible to the browser. In a sandbox-escape scenario (requiring additional vulnerabilities), the impact could extend to the underlying operating system, though no such chaining has been publicly documented for this CVE (Feedly).

1. Reconnaissance: Identify targets running Google Chrome versions prior to 145.0.7632.109 or unpatched Microsoft Edge (Chromium-based), using browser fingerprinting techniques on attacker-controlled web pages.
2. Craft malicious HTML page: Develop a web page containing JavaScript that triggers the integer overflow in V8's engine — for example, by performing arithmetic operations on large integer values or typed arrays that cause V8 to miscalculate buffer sizes.
3. Deliver the payload: Host the crafted page on an attacker-controlled server and lure the victim via phishing email, malicious advertisement, or compromised website redirect.
4. Trigger heap corruption: When the victim visits the page, the malicious JavaScript executes in V8, causing an integer overflow that corrupts heap memory adjacent to the overflowed buffer.
5. Achieve code execution or crash: Depending on exploit sophistication, the attacker either causes a controlled crash (DoS) or leverages the heap corruption to redirect execution flow and run arbitrary code within the Chrome renderer process (Chrome Advisory).

• Network: Unexpected outbound connections from the browser process to unknown external IPs or domains immediately after visiting an unfamiliar web page; unusual DNS lookups for newly registered or low-reputation domains.
• Process: Chrome renderer processes (chrome.exe / chrome on Linux/macOS) spawning unexpected child processes such as cmd.exe, powershell.exe, /bin/sh, or curl; abnormal memory usage spikes in V8-related renderer processes.
• Logs: Browser crash reports or minidumps referencing V8 engine faults; Windows Event Logs showing unexpected process creation events with Chrome as the parent process.
• File System: Unexpected files written to the user's temp directory or Chrome profile directory by the browser process; new scheduled tasks or persistence mechanisms created shortly after browser activity.

Google has released Chrome 145.0.7632.109 (Linux) and 145.0.7632.109/110 (Windows/Mac) which addresses this vulnerability; users should update immediately (Chrome Advisory). Microsoft has released a corresponding patch for Edge (Chromium-based) (Microsoft MSRC). Enabling automatic updates for Chrome and Edge is the most effective mitigation. As a temporary workaround, organizations can restrict access to untrusted or unknown websites via web proxy policies and educate users to avoid clicking suspicious links, since user interaction is required for exploitation.

Google issued an emergency stable channel update on February 18, 2026, describing the fix as addressing three security issues including this High-severity V8 flaw (Chrome Advisory). Security news outlets including CyberSecurityNews, GBHackers, and SecurityOnline covered the update as an urgent patch, with some noting that exploit code for related Chrome vulnerabilities had become public around the same period (NotebookCheck). India's government issued a high-risk warning for Chrome users following the disclosure (TimesNow). The Hacker News included the vulnerability in its weekly security recap, and downstream Linux distributions (Debian, openSUSE, Fedora) issued Chromium security advisories shortly after.