The apparent proof-of-concept code posted last weekend on GitHub for a high-severity bug in Google Chrome was built in part from a regression test that Google’s own engineers shipped with the fix last Wednesday, according to the README file that accompanies it.
The apparent author of the code, an account calling itself Abraxas Labs, said in the README that the files were not a working exploit and that no attempt had been made to turn the flaw into code execution, according to a copy of the document reviewed by Homeland411.
Never Miss An UpdateFollow us on Google News to get our latest security, defense and cyber reporting in your feed. It’s free and takes one tap.
Follow on Google News“This pack is the stale load, not a shell,” the author wrote in the README, which was uploaded to the abraxas/chrome-v8-maglev-literal-stale repository at 02:23 UTC on Sunday, according to GitHub’s record of the upload.
The flaw at issue in the code posted Sunday, CVE-2026-126910, was patched last Wednesday in a Chrome update that also fixed 82 other security bugs, none of which were flagged as being used in attacks at the time, according to Google’s advisory.
The update that carried the fix was Chrome 157.0.8103.78 for Linux and 157.0.8103.78 or .79 for Windows and Mac, according to that same advisory.
The CVE entry for the flaw said it “allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page,” and it was rated High by Chromium.
Compiler kept a value it should have dropped
The bug was caused in part by the way a compiler inside Chrome’s V8 engine known as Maglev handled a value it had already looked up once on Object.prototype, according to the README and to a copy of the patch that Google engineers published with the fix.
The value that Maglev had stored was left in place after the page went on to create an object or an array, a step that changed the prototype underneath but was not treated by the compiler as a write, according to the README.
The test in the repository was run by its author against two builds of Chrome, and the older of the two, 157.0.8103.50, was said to have returned the string “WRONG” where the patched build returned “TRUE”, according to the results printed in the README.
The patch that closed the hole was credited in the README to V8 engineer Marja Hölttä and was said to have been reviewed by Darius Mercadier, according to the same document.
The test page was taken in part from Google’s own regression files and was made to work with a debugging command that is only switched on when Chrome is started with a developer flag, according to the README, in which the author conceded that “a real page would wait for Maglev’s normal tier-up.”
The original Chromium bug report, No. 574059463, was still closed to the public when the code was posted, according to the README.
Six more Chrome repositories the same day
That same account was responsible for six other repositories uploaded on Sunday that were aimed at bugs fixed in the same Chrome release last week, according to a review of its GitHub page.
The bugs covered by those six were listed by the account as CVE-2026-126902, CVE-2026-126909, CVE-2026-126912, CVE-2026-126915, CVE-2026-126916 and CVE-2026-126919, and they were said to involve Skia, ICU and the browser’s sign-in and file-sharing code, according to the descriptions posted with them.
The V8 repository had not been starred or forked by anyone when it was checked on Sunday morning, according to the counts shown on GitHub.
The flaw would give an attacker who finished the job control of only the sandboxed process that Chrome uses to display a single web page, and a second bug would be needed to get any further, according to the description in the CVE database and the README.
The update is downloaded by Chrome automatically but was designed to be applied only when the program is next launched, which has left browsers that were never closed after last Wednesday without the fix, according to Google’s documentation for administrators.
The fix was not expected to reach programs built on the Electron framework, among them Slack and Visual Studio Code, until their makers shipped updates of their own, as those programs were built with a separate copy of V8.
