CVE-2026-85046: Google Chromium V8 Type Confusion Added to CISA KEV
CISA added CVE-2026-85046, a type confusion flaw in Google Chromium V8, to the KEV catalog on 2026-09-04 with a federal due date of 2026-09-18. Patch Chromium-based browsers and verify version 152.0.7977.82 or later today.
CVE-2026-85046: Google Chromium V8 Type Confusion Added to CISA KEV
TL;DR
CISA added CVE-2026-85046, a type confusion vulnerability in Google Chromium V8, to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-04, with a federal remediation due date of 2026-09-18. Patch all Chromium-based browsers — Google Chrome, Microsoft Edge, Opera, and any embedded Chromium runtime — to version 152.0.7977.82 or later, and verify the version on every managed endpoint and cloud-hosted browser image. Because public proof-of-concept references are already circulating, treat this as an active exploitation risk and prioritize it ahead of routine patch cycles.
What this is
CVE-2026-85046 is a type confusion vulnerability in Google Chromium V8, tracked as CWE-843. A remote attacker can execute arbitrary code inside the browser sandbox via a crafted HTML page. The affected software is Chromium-based browsers, including but not limited to Google Chrome, Microsoft Edge, and Opera; the official summary states the flaw affects Google Chrome prior to 152.0.7977.82. CISA added it to the KEV catalog on 2026-09-04, with a federal due date of 2026-09-18. Known ransomware use is listed as Unknown. CVSS is 8.8 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and EPSS is 0.01462 at the 0.72319 percentile.
Why it matters
A type confusion flaw means the V8 JavaScript engine can be tricked into treating one object type as another, which in this case allows code execution within the browser sandbox when a victim loads a crafted HTML page. Because the vulnerable component is shared across Chromium-based browsers, the patch surface is broader than a single vendor product. The KEV listing is the top-priority signal: it reflects confirmed in-the-wild exploitation and carries a binding federal due date of 2026-09-18. CVSS confirms high impact (C:H/I:H/A:H) with a network attack vector and user interaction required, which justifies an emergency change window. EPSS is comparatively low, but a KEV listing overrides model-based scoring — do not let a low EPSS score deprioritize a KEV entry.
How it works
V8 is the JavaScript engine shared across Chromium-based browsers. In this case, the engine can be made to treat one object type as another, and that confusion allows code execution inside the browser sandbox when a victim loads a crafted HTML page. The attack vector is network-based (AV:N) and requires user interaction (UI:R), so any internet-connected browser session is a potential exposure point. The official summary states the flaw affects Google Chrome prior to 152.0.7977.82; the fixed build is 152.0.7977.82 or later per the vendor's stable channel update. The same update cadence applies to Edge, Opera, and any downstream Chromium consumers.
Detection and response
The hypothesis to test is whether any Chromium-based browser or embedded Chromium runtime in your estate is still running a build below 152.0.7977.82. Evidence that confirms it: a reported browser version lower than 152.0.7977.82 on an endpoint, golden image, or cloud-hosted browser service, matched against the vendor advisory and the KEV entry. Evidence that rejects it: a reported version at or above 152.0.7977.82 on every inventoried asset, with no exceptions left unaccounted for.
What to do
- Inventory every Chromium-based browser and runtime. Include Google Chrome, Microsoft Edge, Opera, and any application embedding Chromium or V8 (Electron apps, headless browser automation, CI runners, and container base images). Record version, owner, and internet exposure for each asset.
- Patch to the fixed build. Upgrade to Chromium/Chrome 152.0.7977.82 or later per the vendor's stable channel update. Apply the same update cadence to Edge, Opera, and any downstream Chromium consumers.
- Apply mitigations where patching is not immediately possible. Follow vendor instructions and CISA's BOD 26-04 guidance. If mitigations are unavailable for a given asset, evaluate discontinuing use of the product for that use case.
- Verify the fix. Confirm the reported browser version on endpoints, golden images, and cloud-hosted browser services. Re-scan after deployment to catch assets that missed the update.
- Assess exposure and triage. Evaluate each asset's internet exposure and follow CISA's Forensics Triage Requirements for BOD 26-04 implementation. Prioritize internet-facing and user-facing browser sessions.
- Close the ticket with evidence. Attach version confirmation, asset coverage counts, and any exceptions with compensating controls. Document the remediation date against the 2026-09-18 deadline.
FAQ
Is CVE-2026-85046 in CISA KEV? Yes. CISA added CVE-2026-85046 to the Known Exploited Vulnerabilities catalog on 2026-09-04.
What is the CISA due date for CVE-2026-85046? The federal remediation due date is 2026-09-18, giving organizations a two-week window from the KEV addition.
Is this vulnerability internet-facing or remotely exploitable? Yes. The attack vector is network-based (AV:N) and requires user interaction (UI:R) — typically a victim loading a crafted HTML page. Any internet-connected browser session is a potential exposure point.
Is CVE-2026-85046 tied to ransomware? Known ransomware use is currently listed as Unknown. Absence of a ransomware association does not reduce urgency given the KEV listing and public PoC references.
Which products are affected? Any browser or application built on Chromium V8, including Google Chrome, Microsoft Edge, and Opera. The official summary specifies Google Chrome prior to 152.0.7977.82.
What is the CVSS score and EPSS score? CVSS is 8.8 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS is 0.01462 at the 0.72319 percentile.
Are there public exploits? Yes. Multiple public proof-of-concept references are circulating on GitHub. Treat exploit availability as confirmed and prioritize patching accordingly.