CVE-2026-85046highunder attackCWE-843

CVE-2026-85046: high-severity vulnerability in Google Chrome

Published · Updated

Follow this CVE+ Monitor Chrome+ Monitor chromium

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a public proof of concept.

ssvc Actcvss 8.8epss 1.8%
from disclosure to weapon1 day
Published on NVDSep 3
1st PoC+1d
CISA KEV+1d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 83/2026 · 25 Sep 2026Vulnerabilidade crítica que afeta o Google Chromium V8read on gov.br ↗
  • CISC Gov.br · 16 Sep 2026Boletim do CISC de Vulnerabilidadesread on gov.br ↗
  • CISC Gov.br · 09 Sep 2026Boletim do CISC de Vulnerabilidadesread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Action required by CISAfederal deadline: 2026-09-18

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

A flaw in Chrome's V8 engine allows attackers to confuse data types through a crafted webpage, enabling them to run malicious code within the browser's sandbox. This could compromise your browser security and data.

Technical detail

Type confusion vulnerability in V8 (CWE-843) exploitable via crafted HTML pages, requiring only user interaction (visiting a malicious site). The attack executes arbitrary code within the V8 sandbox, potentially bypassing sandbox isolation and affecting Chrome versions prior to 152.0.7977.82.

Summary generated and translated by AI from the official description.
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Google · Chrome
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Google Chrome

In the same product, most dangerous first.

CVE-2023-4863HIGHCVE-2023-4863EPSS 100.0%KEVCVE-2018-17463HIGHCVE-2018-17463EPSS 84.6%KEVCVE-2021-21224HIGHCVE-2021-21224EPSS 84.2%KEVCVE-2020-6418HIGHCVE-2020-6418EPSS 78.8%KEVCVE-2022-2294HIGHCVE-2022-2294EPSS 70.8%KEVCVE-2021-21220HIGHCVE-2021-21220EPSS 70.4%KEV