Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-85046 |
| Alert source | CISA KEV - actively exploited vulnerability |
| CVE year | 2026 |
| Publication date | 2026-09-04 |
| Vendor | |
| Product | Chrome (V8 engine) |
| Fixed version | 152.0.7977.82 |
| CVSS Score | 8.8 (High) |
| EPSS Score | 1.16% (65th percentile) |
| CISA KEV | Yes |
| CISA deadline | 2026-09-18 |
| Ransomware | Not confirmed |
Vulnerability Description
A type confusion flaw has been found in V8, the JavaScript engine behind Google Chrome, in versions prior to 152.0.7977.82. This class of bug makes the engine treat a region of memory as an object of a different type than the one actually stored there, allowing reads and writes beyond the intended boundaries and, ultimately, arbitrary code execution.
The attack vector is a crafted HTML page. No file download or installer is required — the browser simply has to render content prepared by the attacker.
This vulnerability is already being exploited. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 18 September 2026. That is the essential difference from most browser advisories: this is not a theoretical risk but a technique in active use.
What this flaw does not do on its own. The code executes inside the browser sandbox — the layer that separates page content from the operating system. To take over the workstation, an attacker needs a second flaw that escapes the sandbox. This is worth stating plainly, because browser alerts are often read as “immediate machine compromise”, and that is not the case here. It does not make the issue trivial, though: two-bug chains are the standard technique in browser attacks, and attackers already hold this first half.
Mind the release order. If you rolled out an update after our earlier alert about six flaws in Chrome 152, that was version 152.0.7977.75. It does not contain the fix for CVE-2026-85046 — the newer 152.0.7977.82 release is required.
Required Actions
- Update Chrome to 152.0.7977.82 or later. You can check the version at
chrome://settings/help, which also triggers an update check. - Force a browser restart. Chrome downloads updates in the background, but the new code only runs after the process restarts. A workstation with a downloaded but unrestarted browser remains vulnerable — and users can leave Chrome open for weeks.
- Review Chrome Enterprise policies. The
TargetVersionPrefixandUpdateDefaultsettings are often configured to defer rollouts by days or weeks. For a KEV-listed vulnerability, that deferral needs to be deliberately shortened. - Update other Chromium-based browsers — Microsoft Edge, Brave, Opera, Vivaldi. The flaw sits in V8, a shared component, so it affects them too; vendors ship their own releases with the same fix, usually within days.
- Inventory Electron-based desktop applications (messaging clients, cloud clients, internal tools). They bundle their own copy of Chromium, which does not update alongside the browser and stays vulnerable until the application itself ships a new version. This is the most commonly overlooked part of the fleet.
Who Is Affected?
The vulnerability affects Google Chrome versions prior to 152.0.7977.82 — stable channel, on all platforms: Windows, macOS and Linux.
In practice it affects every organisation that issues employees workstations with Chrome. It also indirectly affects users of other Chromium-based browsers and of applications built on Electron.
Organisations where the browser is the primary interface to business systems — mail, ERP, cloud consoles and admin panels — should pay particular attention. There, a compromised browser means access to the user’s session tokens, and therefore to everything they are logged into.
Sources
- NVD - CVE-2026-85046
- CISA Known Exploited Vulnerabilities Catalog
- Chrome Releases - Stable Channel Update for Desktop
- Chromium issue 542403045
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is CVE-2026-85046?
It is a type confusion flaw in the V8 JavaScript engine used by Google Chrome in versions prior to 152.0.7977.82. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. It carries a CVSS score of 8.8, and Chromium rates the security severity as High.
How does this differ from the earlier Chrome 152 alert?
The earlier alert covered release 152.0.7977.75 and six flaws leading to sandbox escape. This one covers the newer 152.0.7977.82 release and a single flaw that is already being exploited in the wild - it has been added to the CISA KEV catalog. Updating to the version from the previous alert does not close CVE-2026-85046.
What does 'code execution inside the sandbox' mean?
The Chrome sandbox isolates page code from the operating system. This flaw on its own does not break that isolation - it gives the attacker code execution inside the renderer process. Taking over the workstation requires a second flaw that escapes the sandbox. That lowers the severity of the single bug, but does not make it harmless: two-bug chains are standard practice in browser attacks, and this one is already in use.
What is the CISA deadline for this vulnerability?
18 September 2026. The deadline formally binds US federal agencies, but it is a useful urgency signal elsewhere too - CISA only sets one for vulnerabilities with confirmed active exploitation.
How do I protect my organisation?
Update Chrome to 152.0.7977.82 or later and force a browser restart - a downloaded but unrestarted update does not take effect. Review any Chrome Enterprise policies that defer rollouts. Also update other Chromium-based browsers and any Electron desktop applications, which bundle their own copy of the engine.
