CVE-2009-2935

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-08-27 · updated 2026-06-16
Weakness: CWE-264

Description

Google V8, as used in Google Chrome before 2.0.172.43, allows remote attackers to bypass intended restrictions on reading memory, and possibly obtain sensitive information or execute arbitrary code in the Chrome sandbox, via crafted JavaScript.

Affected products

Google Chrome: through 2.0.172.37; 0.2.149.27, 0.2.149.29, 0.2.149.30, 0.2.152.1, 0.2.153.1, 0.3.154.0 (+23)

References

http://code.google.com/p/chromium/issues/detail?id=18639
http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html
http://osvdb.org/57421
http://secunia.com/advisories/36417
http://www.securityfocus.com/bid/36149
http://www.securitytracker.com/id?1022773
http://www.vupen.com/english/advisories/2009/2420
https://exchange.xforce.ibmcloud.com/vulnerabilities/52902
http://code.google.com/p/chromium/issues/detail?id=18639
http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html
http://osvdb.org/57421
http://secunia.com/advisories/36417

Get alerted when CVE-2009-2935 or the next vulnerability affects your stack