CVE-2026-85046: Google Chrome/Chromium V8 Type Confusion (KEV, in-the-wild 0-day)

CVE-2026-85046 is a type-confusion bug (CWE-843) in the V8 JavaScript engine that lets a remote attacker execute arbitrary code inside the Chrome/Chromium renderer sandbox via a crafted HTML page, Google itself states an exploit for it exists in the wild, and it is listed in the CISA Known Exploited Vulnerabilities catalog, so it is indexed here on KEV grounds even though NVD has not yet published its own Primary CVSS score.

CVE-2026-85046 is a type confusion (CWE-843) in V8, the JavaScript/WebAssembly engine shared by Google Chrome and other Chromium-based browsers. NVD's description states: "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)" (NVD).

NVD's vulnerability status for this CVE is "Analyzed," but the only CVSS metric on file is a Secondary score from an authorized data publisher (source ID 134c704f-9b21-4f2e-91b3-4a467353bcc0, the same ADP that filed CISA's SSVC assessment for this CVE): CVSS v3.1 8.8 (HIGH), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. No NVD Primary CVSS metric has been published as of this run, so per our indexing policy the 8.8 figure is labelled not NVD-confirmed (NVD).

Google's own Chrome Releases blog post for the 2026-09-03 Stable channel update — which bumped Chrome to 152.0.7977.82/.83 (Windows/Mac) and 152.0.7977.82 (Linux) — lists CVE-2026-85046 as a High-severity fix ("Type confusion in V8", bug 542403045, reported by security researcher Salvatore Gulizia, nickname Serotav, on 2026-08-04, with a $1,000 bounty) and states plainly: "Google is aware that an exploit for CVE-2026-85046 exists in the wild" (Chrome Releases: Stable Channel Update for Desktop, 2026-09-03).

CISA added CVE-2026-85046 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-04, with a required-action due date of 2026-09-18; known ransomware-campaign use is listed as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed). CISA's advisory notes the bug can affect any browser built on the vulnerable Chromium/V8 codebase, including Microsoft Edge and Opera, not only Google Chrome itself (CISA KEV).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.0181 (78.543th percentile) (FIRST EPSS).

Because Google has confirmed in-the-wild exploitation and the only remediation is updating, any Chrome install below 152.0.7977.82 (or any other Chromium-based browser bundling a V8 build before 15.3.48) should be updated immediately; browsers auto-update by default, but fleets with update policies pinned to older builds should verify and push the update rather than assume it already landed.

• Type confusion in V8 in Chrome prior to 152.0.7977.82 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. — NVD
• Only a Secondary CVSS v3.1 score of 8.8 is published by an authorized data publisher; no NVD Primary metric exists as of this run. — NVD
• The 2026-09-03 Chrome Stable update to 152.0.7977.82/.83 fixes CVE-2026-85046 (bug 542403045, reported by Salvatore Gulizia/Serotav on 2026-08-04); Google states an exploit for it exists in the wild. — Chrome Releases Blog
• Added to the CISA KEV catalog on 2026-09-04, due date 2026-09-18; can affect any Chromium/V8-based browser, not just Chrome; known ransomware-campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.0181 (78.543th percentile) as of 2026-10-30. — FIRST EPSS