Skip to content

Chrome V8 CVE-2026-85046 type-confusion exploitation

Summary

CVE-2026-85046 is a high-severity type-confusion vulnerability in V8, Chrome's JavaScript and WebAssembly engine. On September 4, 2026 Google released a Chrome Stable update (152.0.7977.82/.83 for Windows and macOS, 152.0.7977.82 for Linux) that patched 12 vulnerabilities and explicitly stated that an exploit for CVE-2026-85046 exists in the wild.

The flaw lets a remote attacker execute arbitrary code inside the Chrome sandbox via a crafted HTML page in Chrome prior to 152.0.7977.82 (NVD CVSS 8.8). This is the sixth actively-exploited Chrome zero-day of 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645.

The durable defender lesson repeats: treat a browser zero-day as active client-side exploitation even when the advisory withholds campaign, target, and exploit-chain detail, and push the fixed build across all Chromium-based surfaces.

Tags

CISA KEV listing

  • 2026-09-04: CISA added CVE-2026-85046 to the Known Exploited Vulnerabilities catalog under BOD 26-04, with a patch deadline of 2026-09-18 (14 days). The entry names Google Chromium V8 and states the flaw "allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page," explicitly calling out Google Chrome, Microsoft Edge, and Opera as affected Chromium users (CWE-843). CISA requires federal stakeholders to apply vendor mitigations and evaluate internet exposure per BOD 26-04; no ransomware campaign use and no forensic-triage flag recorded. This converts the Google-stable-only update signal into a hard federal patch deadline and a BOD 26-04 compliance obligation for affected Chromium deployments.

Why this matters

  • Chrome and Chromium-derived browsers are high-reach client-side attack surface across enterprise endpoints, developer workstations, and BYOD systems.
  • V8 type-confusion bugs can be triggered through crafted web content; the NVD description for CVE-2026-85046 is arbitrary code execution inside the Chrome sandbox via a crafted HTML page in versions before 152.0.7977.82.
  • Google confirmed in-the-wild exploitation but published no actor, target, lure, or post-exploitation detail, so defenders should not wait for named-campaign reporting before patching.
  • Other Chromium-based browsers (Edge, Brave, Opera, Vivaldi, embedded Chromium runtimes) may need separate vendor updates after the Chrome fix lands.

Operational characteristics

  • Affected component: Google Chrome V8 JavaScript / WebAssembly engine.
  • Exploit status: Google says an exploit for CVE-2026-85046 exists in the wild.
  • Vulnerability class: type confusion in V8. Researcher Salvatore Gulizia (aka Serotav) described it as "a V8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, which can be turned into arbitrary read/write on the JavaScript heap."
  • CVSS: 8.8 (high).
  • Fixed Chrome versions: 152.0.7977.82/.83 for Windows and Apple macOS; 152.0.7977.82 for Linux, rolling out from 2026-09-04.
  • CISA KEV: added 2026-09-04 under BOD 26-04; patch due date 2026-09-18; no forensic-triage flag; no known ransomware campaign use (see CISA KEV listing).
  • Discovery / disclosure: reported by Salvatore Gulizia (Serotav) on 2026-08-04; awarded a $1,000 bug bounty.
  • Public attribution: none in the reviewed public sources. Keep actor, malware, and target-sector attribution unset unless Google, CISA, or another primary source publishes follow-up detail.
  • Context: this is the sixth actively-exploited Chrome zero-day of 2026 (CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046).

Defender heuristics

  • Prioritize emergency update coverage for Chrome on endpoints that browse the open internet, handle email/web links, or run privileged SaaS and administrative sessions.
  • Verify Chromium-derived browsers separately (Microsoft Edge, Brave, Vivaldi, Opera, embedded Chromium runtimes in enterprise software) and apply vendor fixes as they ship.
  • Hunt for endpoints that accessed unusual web content shortly before browser crashes, renderer-process anomalies, sandbox escapes, unsigned child processes, unexpected download execution, credential prompts, or suspicious extension changes.
  • Correlate endpoint events with proxy, DNS, secure-web-gateway, and EDR telemetry around the 2026-09-04 patch window; preserve evidence before wiping systems where exploitation is suspected.
  • For high-risk users, consider temporary isolation or stricter browser/site controls until update telemetry confirms the 152.0.7977.82 build is deployed.

Sources