跳到主要内容

高危

Google Chromium <146.0.7680.75 V8代码执行漏洞

2026-03-12 21:30:51 公开 ,2026-03-16 02:43:51 更新

  • CISA KEV
  • 关键漏洞
  • 公开PoC
  • CWE Top 25 (2023)
  • CWE Top 25 (2024)
  • 远程
  • 无需认证
CWEs:
CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) CWE-94 (Code Injection)
CAPEC:
CAPEC-10 (Buffer Overflow via Environment Variables) CAPEC-100 (Overflow Buffers) CAPEC-123 (Buffer Manipulation) CAPEC-14 (Client-side Injection-induced Buffer Overflow) CAPEC-24 (Filter Failure through Buffer Overflow) CAPEC-242 (Code Injection) CAPEC-35 (Leverage Executable Code in Non-Executable Files) CAPEC-42 (MIME Conversion) CAPEC-44 (Overflow Binary Resource File) CAPEC-45 (Buffer Overflow via Symbolic Links) CAPEC-46 (Overflow Variables and Tags) CAPEC-47 (Buffer Overflow via Parameter Expansion) CAPEC-77 (Manipulating User-Controlled Variables) CAPEC-8 (Buffer Overflow in an API Call) CAPEC-9 (Buffer Overflow in Local Command-Line Utilities)
SSVC:
可利用状态:已被积极利用攻击自动化:否技术影响评估:全部 2026-03-13 08:00:00

风险信息

CVSS v3.1 向量
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v3.1 风险值
8.8

详细信息

漏洞类型
代码注入
漏洞描述
在146.0.7680.75之前的Google Chrome V8中存在内存缓冲区范围内的操作限制不当漏洞,可能导致远程攻击者通过精心构造的HTML页面在沙箱内执行任意代码。漏洞可能影响采用Chromium的多个浏览器,包括但不限于谷歌Chrome、微软Edge和Opera。
修复建议
请升级Google Chrome到146.0.7680.75/76或更高版本,参考链接: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html

参考链接