Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-85046 |
| Alert source | CISA KEV - actively exploited vulnerability |
| CVE year | 2026 |
| Publication date | 2026-09-04 |
| Vendor | |
| Product | Chrome (V8 engine) |
| Fixed version | 152.0.7977.82 |
| CVSS Score | 8.8 (High) |
| EPSS Score | 1.16% (65th percentile) |
| CISA KEV | Yes |
| CISA deadline | 2026-09-18 |
| Ransomware | Not confirmed |
Vulnerability Description
A type confusion flaw has been found in V8, the JavaScript engine behind Google Chrome, in versions prior to 152.0.7977.82. This class of bug makes the engine treat a region of memory as an object of a different type than the one actually stored there, allowing reads and writes beyond the intended boundaries and, ultimately, arbitrary code execution.
The attack vector is a crafted HTML page. No file download or installer is required — the browser simply has to render content prepared by the attacker.
This vulnerability is already being exploited. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 18 September 2026. That is the essential difference from most browser advisories: this is not a theoretical risk but a technique in active use.
What this flaw does not do on its own. The code executes inside the browser sandbox — the layer that separates page content from the operating system. To take over the workstation, an attacker needs a second flaw that escapes the sandbox. This is worth stating plainly, because browser alerts are often read as “immediate machine compromise”, and that is not the case here. It does not make the issue trivial, though: two-bug chains are the standard technique in browser attacks, and attackers already hold this first half.
Mind the release order. If you rolled out an update after our earlier alert about six flaws in Chrome 152, that was version 152.0.7977.75. It does not contain the fix for CVE-2026-85046 — the newer 152.0.7977.82 release is required.
Required Actions
- Update Chrome to 152.0.7977.82 or later. You can check the version at
chrome://settings/help, which also triggers an update check. - Force a browser restart. Chrome downloads updates in the background, but the new code only runs after the process restarts. A workstation with a downloaded but unrestarted browser remains vulnerable — and users can leave Chrome open for weeks.
- Review Chrome Enterprise policies. The
TargetVersionPrefixandUpdateDefaultsettings are often configured to defer rollouts by days or weeks. For a KEV-listed vulnerability, that deferral needs to be deliberately shortened. - Update other Chromium-based browsers — Microsoft Edge, Brave, Opera, Vivaldi. The flaw sits in V8, a shared component, so it affects them too; vendors ship their own releases with the same fix, usually within days.
- Inventory Electron-based desktop applications (messaging clients, cloud clients, internal tools). They bundle their own copy of Chromium, which does not update alongside the browser and stays vulnerable until the application itself ships a new version. This is the most commonly overlooked part of the fleet.
Who Is Affected?
The vulnerability affects Google Chrome versions prior to 152.0.7977.82 — stable channel, on all platforms: Windows, macOS and Linux.
In practice it affects every organisation that issues employees workstations with Chrome. It also indirectly affects users of other Chromium-based browsers and of applications built on Electron.
Organisations where the browser is the primary interface to business systems — mail, ERP, cloud consoles and admin panels — should pay particular attention. There, a compromised browser means access to the user’s session tokens, and therefore to everything they are logged into.
Sources
- NVD - CVE-2026-85046
- CISA Known Exploited Vulnerabilities Catalog
- Chrome Releases - Stable Channel Update for Desktop
- Chromium issue 542403045
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
