CVE-2026-85046Active Exploitation(google / chrome)

CRITICALCVSS 8.8 · HIGHCISA KEV

Exploitation observed; activity peaked at 69 mentions and remains active

Immediate actions

Patch google chrome systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

google CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-18. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Patch / fix

https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67

Exploit / PoC references

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-843

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chrome
v8

Threat summary

Active exploitation appears in 259 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
324 mentions across 26 observed days

What's happening

Active exploitation reported across 259 signals
Exploit tool or code specified in 15 signals
PoC mentioned or linked in 17 signals
Patch or workaround mentioned in 222 signals
Technical details provided in 227 signals
Disclosure: 16 classified signals
Peaked 24d ago at 69 mentions (2026-09-04); latest day: 1
324 total mentions across 26 days

Affected systems

Vendors

google

Products

chromev8

Deep dive

Activity timeline324 mentions / 26d

Signal classification6 categories

Active Exploitation

20464.2%

Patch

8125.5%

Disclosure

165.0%

General

123.8%

Exploit

30.9%

PoC

20.6%

Referenced assets175 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-03	5	Active Exploitation3Disclosure1Patch1
2026-09-04	69	Active Exploitation48Disclosure2Patch19
2026-09-05	69	Active Exploitation42Disclosure2General3Patch22
2026-09-06	30	Active Exploitation19Patch11
2026-09-07	38	Active Exploitation21Disclosure2General4Patch11
2026-09-08	23	Active Exploitation10Disclosure1Patch12
2026-09-09	12	Active Exploitation6Disclosure2General1Patch2PoC1
2026-09-10	19	Active Exploitation14Disclosure2Exploit1General1Patch1
2026-09-11	10	Active Exploitation8Exploit1PoC1
2026-09-12	5	Active Exploitation3Exploit1Patch1
2026-09-13	2	Active Exploitation2
2026-09-14	7	Active Exploitation5General2
2026-09-15	6	Active Exploitation5Disclosure1
2026-09-16	4	Active Exploitation2Disclosure1General1
2026-09-17	2	Active Exploitation1
2026-09-18	3	Active Exploitation2Patch1
2026-09-21	4	Active Exploitation3Disclosure1
2026-09-22	2	Active Exploitation2
2026-09-23	2	Active Exploitation2
2026-09-25	2	Active Exploitation1Disclosure1
2026-09-26	2	Active Exploitation2
2026-09-28	1	Active Exploitation1
2026-10-01	2	Active Exploitation2

Full discourse20 posts

The Hacker News@TheHackersNews46d
Active Exploitation
‼️ WARNING - Attackers are exploiting a Chrome V8 zero-day. CVE-2026-85046 allows arbitrary code execution inside the browser sandbox via a crafted HTML page. Google fixed it in Chrome 152.0.7977.82/.83. How the V8 type confusion works: https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html
Post summary
CVE‑2026‑85046, a Chrome V8 type‑confusion flaw, is reportedly being exploited in the wild, enabling arbitrary code execution through crafted HTML; Google has patched the vulnerability in recent Chrome releases.
121271038113381.1K
2.4M followersView on X
Zero Day Engineering@zerodayalpha41d
Active Exploitation
⚡️ 0-Day Alert: Chrome v8 RCE exploited in the wild CVE-2026-85046: v8 array-builtin callback side-effect to elements-kind transition confusion. Affects both Turbofan and Maglev. Exploit will work in default config but requires multiple other bugs to achieve arbitrary code execution on the system. The bug alone without helpers could do for an UXSS. Patched in Chrome 152.0.7977.82/.83
Post summary
CVE‑2026‑85046, a Chrome V8 RCE, was reported to have been exploited in the wild and requires auxiliary bugs; it has been fixed in Chrome 152.0.7977.82/.83.
23822279530.4K
11.8K followersView on X
LiveOverflow 🔴@LiveOverflow42d
Patch
Oh! The fix for the bug I used in this n-day exploit was finally shipped. [542403045] High CVE-2026-85046: Type confusion in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-04 https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html
Post summary
The update confirms that a patch for CVE-2026-85046, a type‑confusion vulnerability in V8, has been released following its use in an n‑day exploit.
4701645619.5K
163.8K followersView on X
Volexity@Volexity40d
Active Exploitation
Earlier this month, @Volexity detected multiple Chinese threat actors launching attacks against its customers using chained 0-day exploits in Google Chrome (CVE-2026-85046 & CVE-2026-87491) and Microsoft Windows (CVE-2026-85880). Volexity observed threat actors it tracks as UTA0560 and JungleBamboo using variations of the same exploits to deliver different malware implants. These implants ranged from a JScript backdoor (GRIMWEDGE) to a fake Google Gemini Chrome extension (LONGTALE). Read the full analysis of the exploit chain and post-exploitation tradecraft here: https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/ #DFIR #threatintel
Post summary
Chinese threat actors were observed actively exploiting chained 0‑day CVEs in Google Chrome and Windows to deliver diverse malware implants, as detailed in a recent Volexity analysis.
24911003713.7K
8.5K followersView on X
Sooraj@iAnonymous300045d
Patch
Take app, browser, and OS updates more seriously than ever. The economics of exploitation are changing fast. Brave desktop build 1.94.121 includes the Chromium fix for CVE-2026-85046 [a V8 vulnerability for which Google confirms an exploit exists in the wild]. Now connect that with OpenAI’s latest results. GPT-6 Astra scored 100% on ExploitBench. This benchmark gives an AI agent a known V8 vulnerability, source code, debugging tools and the patch (but no reference PoC). It measures progress toward arbitrary code execution. V8 is the engine involved in the browser bug above. My takeaway: as exploit development gets easier, delaying security updates becomes harder to justify. A published patch gives defenders a fix. It can also give attackers clues about how to exploit devices that haven’t updated. If Brave says “Relaunch to update,” do it now.
Post summary
The post highlights that CVE-2026-85046, a V8 browser engine vulnerability, is actively exploited in the wild, a patch exists, and users should update immediately.
5201139189.4K
15.3K followersView on X
elhacker.NET@elhackernet44d
Active Exploitation
Vulnerabilidad crítica de Chrome explotada activamente Google ha lanzado una actualización de seguridad de emergencia para Chrome para corregir una vulnerabilidad crítica de día cero (CVE-2026-85046) que ya está siendo explotada en ataques reales El fallo afecta al motor V8 de JavaScript y WebAssembly, utilizado por el navegador para procesar contenido web https://blog.elhacker.net/2026/09/vulnerabilidad-critica-de-chrome.html
Post summary
Google issued an emergency patch for CVE-2026-85046, which targets the V8 JavaScript engine in Chrome and is currently being actively exploited in real-world attacks.
1371113167.9K
142.4K followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi45d
Active Exploitation
عاجل ‼️🚨 ثغرة خطيرة (Zero-Day) في متصفح Chrome تستغل حاليا من قبل المخترقين حدث فوراً وإذا كنت مسؤول عن إدارة الثغرات في المنظمة حدث اجهزة الموظفين بشكل عاجل هالنوع من الثغرات خطير لأنه فرصة يستغلها المخترقين في رسائل التصيد رقم الثغرة: CVE-2026-85046 التقييم: 8.8 - خطيرة https://t.co/pJQnpE0uF1
Post summary
The tweet warns that Chrome is suffering a Zero‑Day CVE‑2026‑85046, currently being exploited in the wild, urging immediate action to update devices.
260807012.0K
50.2K followersView on X
Volexity@Volexity28d
Active Exploitation
Following @Volexity's September 9 blog post on two Chinese APT actors chaining 0-days in Chrome (CVE-2026-85046, CVE-2026-87491) & Windows (CVE-2026-85880), Volexity discovered another threat actor, UTA0565, had been using the same exploits on Sept 3-4, 2026, while they were still unpatched. UTA0565 used multiple fake websites, posing as media organizations and an NGO, to run a more customized version of the exploit framework than previously documented instances. The payload delivered was a new custom malware family, CLEANGULP, obfuscated using control flow flattening. Full details and IOCs can be found here: https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/ #DFIR #threatintel
Post summary
Volexity reports that threat actor UTA0565 actively exploited unpatched Chrome and Windows vulnerabilities (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) using a customized exploit framework, deploying new malware CLEANGULP via fake websites.
330074266.4K
8.5K followersView on X
Nicolas Krassas@Dinosn43d
Active Exploitation
Actively exploited sandbox RCE in all Chromium versions (CVE-2026-85046) https://nvd.nist.gov/vuln/detail/cve-2026-85046
Post summary
CVE-2026-85046 is a sandbox RCE affecting all Chromium versions; it is actively exploited in the wild, but no PoC, exploit code, patch, or detailed technical data are shared in the text.
17073438.9K
162.5K followersView on X
xvonfers@xvonfers39d
Active Exploitation
Chained with CVE-2026-85046(type confusion -> arb r/w) & exploited itw, reported by Salvatore Gulizia (Serotav) https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html Fixed here: https://chromium.googlesource.com/v8/v8/+/e0562d87ad9c17042b581582c99237d798572e67 PoC: https://chromium.googlesource.com/v8/v8/+/e0562d87ad9c17042b581582c99237d798572e67/test/mjsunit/regress/regress-crbug-542403045.js Writeup with exploitation: https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/
Post summary
CVE-2026-85046, a type‑confusion vulnerability leading to arbitrary read/write, has been exploited in the wild. PoC, writeup, and patch links are supplied.
012055445.3K
5.0K followersView on X
Abhishek@aacle_40d
PoC
CVE-2026-85046 is fun to read about its type v8 confusion turns into addrof ⇢ fakeobj ⇢ arbitary read/write all from a browser page Exploit Notes: https://github.com/atiilla/CVE-2026-85046/blob/main/exploit-notes.md https://t.co/4K8F4eiBPW
Post summary
The post highlights CVE‑2026‑85046, providing a link to detailed exploit notes and describing V8 confusion leading to arbitrary read/write, but no patch or active exploitation information.
19058355.0K
49.6K followersView on X
Dark Web Intelligence@DailyDarkWeb42d
Active Exploitation
🚨 GOOGLE CHROME VULNERABILITY ACTIVELY EXPLOITED — UPDATE NOW Google has released an emergency security update for Chrome addressing CVE-2026-85046, a high-severity vulnerability that is being exploited in the wild. CVE-2026-85046 is a type-confusion vulnerability in V8, Chrome's JavaScript and WebAssembly engine. Google confirmed: "Google is aware that an exploit for CVE-2026-85046 exists in the wild." The vulnerability was reported by security researcher Salvatore Gulizia (Serotav) on August 4. The September 3 Chrome release contains 12 security fixes in total, including several high-severity memory-safety vulnerabilities. Affected: * Google Chrome versions prior to 152.0.7977.82 Updated versions: * Windows / macOS: 152.0.7977.82/.83 * Linux: 152.0.7977.82 🚨 CISA ADDS CVE TO KEV On September 4, CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The Canadian Centre for Cyber Security has also issued an advisory urging users and administrators to apply the necessary updates. ⚠️ Analyst Note: The combination of a V8 vulnerability and confirmed exploitation deserves immediate attention. Browser vulnerabilities provide attackers with an attractive initial-access surface because exploitation can potentially begin simply through malicious or compromised web content. Google is currently restricting detailed technical information about the vulnerability while users receive the update — a common precaution intended to reduce the opportunity for additional exploitation before patch adoption reaches sufficient levels. Organizations should prioritize updating managed Chrome installations and verify deployment rather than relying solely on automatic-update policies. Official sources: Google Chrome Security Release: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html Canadian Centre for Cyber Security: https://www.cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-883 CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog #DDW #GoogleChrome #CVE #CyberSecurity #Vulnerability
Post summary
This post confirms that CVE‑2026‑85046, a type‑confusion flaw in Chrome’s V8 engine, is actively exploited in the wild, and it highlights the emergency patch released by Google.
713064199.0K
208.5K followersView on X
Rıdvan Yağlı@ridvanyagli39d
PoC
CVE-2026-85046 PoC: https://chromium.googlesource.com/v8/v8/+/e0562d87ad9c17042b581582c99237d798572e67/test/mjsunit/regress/regress-crbug-542403045.js CVE-2026-85046 Write-up: https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/
Post summary
The post delivers a proof‑of‑concept reference and a write‑up for CVE‑2026‑85046, indicating that the vulnerability is demonstrably exploitable, though no active attacks or mitigations are mentioned.
17036367.0K
2.4K followersView on X
Rıdvan Yağlı@ridvanyagli43d
Active Exploitation
🔴 Chrome'da aktif olarak istismar edilen 0-day: CVE-2026-85046 ! Google Chrome'un V8 JavaScript motorundaki Type Confusion (CWE-843) açığı, özel hazırlanmış bir HTML sayfası üzerinden uzaktaki saldırganın Chrome sandbox'ı içerisinde keyfi kod çalıştırmasına izin verebiliyor. ⚠️ CVSS v3.1: 8.8 (High) 📌 Vektör: "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" 🛠️ Etkilenen sürüm: Chrome < 152.0.7977.82 ✅ Çözüm: 152.0.7977.82/.83 ve üzerine güncellemek. Chrome kullanıcılarının tarayıcılarını acilen güncellemeleri öneriliyor.
Post summary
CVE-2026-85046 is an actively exploited 0‑day Type Confusion flaw in Chrome’s V8 engine; a patch is available and users must update immediately.
023443125.8K
2.4K followersView on X
وهبي بن محمد@wahbi_444d
Active Exploitation
مستخدمو Chrome وChromium: CISA أضافت CVE-2026-85046 في محرك V8 إلى كتالوج الثغرات المستغَلة، حدّثوا المتصفح فورًا. #CISA #Chrome https://t.co/PIggbSLv1a
Post summary
CISA flagged CVE‑2026‑85046 as an actively exploited vulnerability in Chrome’s V8 engine, urging users to update the browser immediately.
152402811.5K
875.7K followersView on X
情報の灯台@joho_no_todai45d
Patch
Chromeの更新を今すぐ確認してほしい。 V8エンジンに型混同の脆弱性（CVE-2026-85046）が見つかり、攻撃への悪用がすでに確認されている。今年のChromeゼロデイ修正は6件目。 6件中3件がV8を狙ったもので、JavaScriptエンジンが集中的に標的になっている。「設定」→「Chromeについて」からバージョン152.0.7977.82/.83へ。
Post summary
The post alerts users to a type‑confusion CVE in V8, confirms active exploitation, and advises updating Chrome to specific patched versions.
12004074.3K
12.6K followersView on X
CERT@certlv45d
Active Exploitation
‼️ Google Chrome pārlūkprogrammā ir atklāta ievainojamība CVE-2026-85046, kas jau pirms drošības "ielāpa" publicēšanas tika aktīvi izmantota uzbrukumos. Nepieciešams atjaunināt un restartēt pārlūkprogrammu. Vairāk: https://www.cert.lv/lv/2026/09/uzbrukumos-izmantota-ievainojamiba-google-chrome https://t.co/uohc991jnc
Post summary
CVE-2026-85046 in Google Chrome has been actively exploited before its patch was released; users are advised to update and restart the browser.
01802833.9K
5.7K followersView on X
CISA Cyber@CISACyber41d
Active Exploitation
🛡️ We added Google Chromium V8 type confusion vulnerability CVE-2026-85046 to our Known Exploited Vulnerabilities Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/k70o0nTu9g
Post summary
The tweet announces that CVE-2026-85046 has been added to a known‑exploited‑vulnerabilities catalog and urges organizations to apply mitigations.
3603448.3K
303.3K followersView on X
Ratan Jyoti@reach2ratan45d
Active Exploitation
CRITICAL ALERT: Chrome V8 Zero-Day (CVE-2026-85046) actively exploited in wild drive-bys. Identify: Audit fleet for chrome.exe versions < 152.0.7977.82 & monitor sudden renderer crashes IoCs: Unusual child processes spawned under browser renderers (cmd, powershell), egress to untrusted IPs post-render, staging files in %TEMP% Mitigation: Patch to Chrome 152.0.7977.82+ immediately and enforce browser relaunch via enterprise policy YARA / Detection: Rule logic targeting JIT confusion: flag high-iteration loops combined with ArrayBuffer/DataView allocations and addrof/fakeobj primitive signatures in JS files cc: @BushidoToken @demonslay335 @JAMESWT_MHT @reach2ratan @Unit42_Intel @malware_traffic @Gi7w0rm @Cryptolaemus1 @Max_Mal_ @anyrun_app @Jane_0sint #CyberSecurity #ThreatIntel #InfoSec #SOC #PatchNow
Post summary
This alert announces that CVE-2026‑85046 is being actively exploited in drive‑by attacks, urging immediate patching to Chrome 152.0.7977.82+ and monitoring of renderer crashes.
01502051.1K
26.9K followersView on X
VulnTracker@vuln_tracker42d
Patch
CVE-2026-85046: type confusion in V8 lets a crafted HTML page trigger remote code execution inside Chrome's sandbox. Rated High by Chromium. Fixed in 152.0.7977.82. Details: https://vulntracker.io/cves/CVE-2026-85046 #CVE #Chrome #V8 #VulnerabilityManagement #InfoSec https://t.co/pP7GgtvYrE
Post summary
A newly disclosed V8 type‑confusion vulnerability (CVE‑2026‑85046) allows remote code execution in Chrome’s sandbox and is mitigated by update 152.0.7977.82, with Chromium rating it high severity.
0102381.7K
816 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	google	chrome	-	-	-
App	google	v8	-	-	-

Explore more

Back to dashboard google CVEs chrome vulnerabilities

What researchers are saying

CVE-2026-85046

LiveOverflow 🔴[verified]@LiveOverflowPatch

The update confirms that a patch for CVE-2026-85046, a type‑confusion vulnerability in V8, has been released following its use in an n‑day exploit.

Volexity[verified]@VolexityActive Exploitation

Chinese threat actors were observed actively exploiting chained 0‑day CVEs in Google Chrome and Windows to deliver diverse malware implants, as detailed in a recent Volexity analysis.

Sooraj[verified]@iAnonymous3000Patch

The post highlights that CVE-2026-85046, a V8 browser engine vulnerability, is actively exploited in the wild, a patch exists, and users should update immediately.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediActive Exploitation

The tweet warns that Chrome is suffering a Zero‑Day CVE‑2026‑85046, currently being exploited in the wild, urging immediate action to update devices.

Volexity[verified]@VolexityActive Exploitation

Volexity reports that threat actor UTA0565 actively exploited unpatched Chrome and Windows vulnerabilities (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) using a customized exploit framework, deploying new malware CLEANGULP via fake websites.

Nicolas Krassas[verified]@DinosnActive Exploitation

CVE-2026-85046 is a sandbox RCE affecting all Chromium versions; it is actively exploited in the wild, but no PoC, exploit code, patch, or detailed technical data are shared in the text.

Abhishek[verified]@aacle_PoC

The post highlights CVE‑2026‑85046, providing a link to detailed exploit notes and describing V8 confusion leading to arbitrary read/write, but no patch or active exploitation information.

Dark Web Intelligence[verified]@DailyDarkWebActive Exploitation

This post confirms that CVE‑2026‑85046, a type‑confusion flaw in Chrome’s V8 engine, is actively exploited in the wild, and it highlights the emergency patch released by Google.