Vulnerability record · CVE-2026-85046 · published 3 September 2026
CVE-2026-85046: Google Chrome V8 type confusion enables sandboxed remote code execution
Google · Chrome
Chrome's V8 JavaScript engine contains a type confusion flaw (CWE-843) fixed in version 152.0.7977.82. A crafted HTML page can trigger the confusion and lead to arbitrary code execution inside the browser sandbox. The issue is rated High by Chromium and carries a CVSS 3.1 base score of 8.8, and it has been added to CISA's Known Exploited Vulnerabilities catalog.
Description
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with remote code execution in a ubiquitous browser and confirmed inclusion in CISA KEV outweigh the moderate EPSS score.
What it is
Chrome's V8 JavaScript engine contains a type confusion flaw (CWE-843) fixed in version 152.0.7977.82. A crafted HTML page can trigger the confusion and lead to arbitrary code execution inside the browser sandbox. The issue is rated High by Chromium and carries a CVSS 3.1 base score of 8.8, and it has been added to CISA's Known Exploited Vulnerabilities catalog.
Impact
An attacker who gets the page rendered can execute arbitrary code within the Chrome sandbox, giving control of the renderer process and a foothold for sandbox escape or further compromise. Confidentiality, integrity and availability impacts are all rated High.
Attack surface
Reached over the network through a crafted HTML page rendered in Chrome; no privileges are required but user interaction (opening or visiting the page) is needed per the CVSS vector AV:N/AC:L/PR:N/UI:R. The flaw lives in V8, so any context that executes attacker-supplied JavaScript is a potential vector.
Exploitation
CVE-2026-85046 is listed in CISA KEV with a remediation due date of 2026-09-18, and public references are tagged as Exploit, indicating known exploitation. EPSS is modest (0.01462, ~72nd percentile), so the KEV listing is the stronger signal. No ransomware campaign use is documented.
What to do
- Update Chrome to 152.0.7977.82 or later on all platforms and confirm the version in chrome://version.
- Apply the referenced V8 patch (commit e0562d87ad9c17042b581582c99237d798572e67) if you build Chromium or V8 from source.
- Prioritize internet-facing and unmanaged endpoints for patching within the CISA KEV due date of 2026-09-18.
- If immediate patching is not possible, restrict browsing to trusted sites and enforce site isolation and other renderer hardening controls.
- Track the Chromium issue 542403045 and vendor release notes for any follow-up fixes.
Detection
- Monitor for Chrome renderer crashes or abnormal process terminations that cluster around browsing of untrusted pages.
- Hunt for chrome.exe or chrome child processes spawning unexpected executables or making anomalous outbound connections.
- Alert on Chrome versions below 152.0.7977.82 across managed endpoints via software inventory.
- Review proxy and DNS logs for access to known exploit-hosting or writeup-linked domains around the time of suspected incidents.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-85046 to the Known Exploited Vulnerabilities catalog on 4 September 2026 as "Google Chromium V8 Type Confusion Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 18 September 2026.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html | Release NotesVendor Advisory |
| https://issues.chromium.org/issues/542403045 | Permissions Required |
| https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md | ExploitThird Party Advisory |
| https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67 | Patch |
| https://news.ycombinator.com/item?id=49570669 | Issue TrackingThird Party Advisory |
| https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/ | ExploitThird Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046 | US Government Resource |
Track CVE-2026-85046 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-85046), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
