CVE-2009-2555: Google Chrome

High severity, CVSS 9.3. EPSS: 3.4% chance of exploitation in the next 30 days.

Heap-based buffer overflow in src/jsregexp.cc in Google V8 before 1.1.10.14, as used in Google Chrome before 2.0.172.37, allows remote attackers to execute arbitrary code in the Chrome sandbox via a crafted JavaScript regular expression.

Affected products

• Google Chrome: up to and including 2.0.172.33; version 0.2.149.29 only; version 0.2.149.30 only; version 0.2.152.1 only; version 0.2.153.1 only; version 0.3.154.0 only; …
• Google v8: up to and including 1.0

Published 2009-07-21. Last modified 2026-06-16.