CVE-2026-85046

What is Chromium V8?

V8 is the open-source JavaScript and WebAssembly engine at the heart of Google Chrome and every Chromium-based browser, including Microsoft Edge, Brave, Opera, and Vivaldi. Because V8 executes untrusted JavaScript from every web page a user visits, it is one of the most attacked codebases in the world — a single V8 bug reachable from a crafted web page gives attackers a drive-by code-execution primitive against billions of browser installations, which is why V8 flaws are a staple of commercial spyware and targeted attack chains.

Overview

CVE-2026-85046 is a type confusion vulnerability in V8 that allows a remote attacker to execute arbitrary code inside the Chrome renderer sandbox via a crafted HTML page. Google confirmed at patch time that "an exploit for CVE-2026-85046 exists in the wild," making this the sixth Chrome zero-day of 2026 (following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645). CISA added it to the KEV catalog on 2026-09-04, two days after the fix shipped.

Affected Versions

Technical Details

The flaw is a type confusion (CWE-843) in V8's handling of array element kinds: a compiler bug causes an array containing PACKED_ELEMENTS to receive the map for PACKED_SMI_ELEMENTS. Because the engine then reasons about the array's memory layout using the wrong type, an attacker who triggers the confusion from JavaScript can convert it into arbitrary read/write on the JavaScript heap and, from there, arbitrary code execution within the renderer process.

Exploitation requires no privileges and only that the victim load attacker-controlled web content (user interaction: required) — the classic drive-by profile. Code execution lands inside Chrome's renderer sandbox, so a full device compromise requires pairing it with a sandbox-escape bug; in-the-wild V8 exploits are routinely deployed as the first stage of exactly such chains.

Discovery

Reported to Google on 2026-08-04 by researcher Salvatore Gulizia ("Serotav"), who received a $1,000 bounty. The in-the-wild exploit was identified separately — Google, per its usual practice for actively exploited zero-days, disclosed no details about the attacker or targets.

Exploitation Context

Google confirmed an exploit exists in the wild before the patch shipped. No attribution, targeting information, or scale has been disclosed — consistent with prior Chrome zero-days, where exploitation is typically limited and targeted (commercial surveillance vendors and state-linked actors are the historical norm) before details become public. As client-side software, there are no internet-exposure counts; the exposed population is effectively every unpatched Chromium browser.

Remediation

1. Update Chrome to 152.0.7977.82 or later (Windows/macOS/Linux) — chrome://settings/help forces the update check; relaunch to apply.
2. Update all Chromium-based browsers (Edge, Brave, Opera, Vivaldi) as vendors ship their rebased releases.
3. Enterprise fleets: verify the deployed version via management tooling and force relaunch — an updated binary is not protected until the browser restarts.
4. Federal agencies must remediate by 2026-09-18 under BOD 22-01.
5. For high-risk users, consider enabling Chrome's Enhanced Safe Browsing and site isolation hardening while updates roll out.