CVE-2026-85046: Google Chromium V8 Type Confusion Added to CISA KEV
CISA added CVE-2026-85046, a type confusion flaw in Google Chromium V8, to the KEV catalog on 2026-09-04 with a federal due date of 2026-09-18. Patch Chromium-based browsers and verify version 152.0.7977.82 or later today.
CVE-2026-85046: Google Chromium V8 Type Confusion Added to CISA KEV
TL;DR
CISA added CVE-2026-85046, a type confusion vulnerability in Google Chromium V8, to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-04, with a federal remediation due date of 2026-09-18. Patch all Chromium-based browsers — Google Chrome, Microsoft Edge, Opera, and any embedded Chromium runtime — to version 152.0.7977.82 or later, and verify the version on every managed endpoint and cloud-hosted browser image. Because public proof-of-concept references are already circulating, treat this as an active exploitation risk and prioritize it ahead of routine patch cycles.
What is this vulnerability?
- CVE ID: CVE-2026-85046
- Vendor / product: Google / Chromium V8
- Vulnerability name: Google Chromium V8 Type Confusion Vulnerability
- Weakness: CWE-843 (Type Confusion)
- Impact: A remote attacker can execute arbitrary code inside the browser sandbox via a crafted HTML page.
- Affected software: Chromium-based browsers, including but not limited to Google Chrome, Microsoft Edge, and Opera. The official summary states the flaw affects Google Chrome prior to 152.0.7977.82.
- CISA KEV status: Yes — added 2026-09-04
- CISA due date: 2026-09-18
- Known ransomware use: Unknown
- CVSS: 8.8 (HIGH), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS: 0.01462 (percentile 0.72319)
A type confusion flaw means the V8 JavaScript engine can be tricked into treating one object type as another, which in this case allows code execution within the browser sandbox when a victim loads a crafted HTML page. Because the vulnerable component is shared across Chromium-based browsers, the patch surface is broader than a single vendor product.
KEV vs CVSS vs EPSS
| Signal | What it measures | How to use it for this CVE |
|---|---|---|
| CISA KEV | Confirmed in-the-wild exploitation, with a binding federal due date | Treat as the top-priority signal. CVE-2026-85046 is listed with a due date of 2026-09-18; federal agencies and BOD 26-04-aligned organizations must remediate by then. |
| CVSS | Theoretical severity of the vulnerability (8.8 HIGH here) | Confirms high impact (C:H/I:H/A:H) with network attack vector and user interaction required. Use it to justify emergency change windows. |
| EPSS | Modeled probability of exploitation in the next 30 days (0.01462, ~72nd percentile) | EPSS is comparatively low, but KEV listing overrides model-based scoring. Do not let a low EPSS score deprioritize a KEV entry. |
Step-by-step remediation
- Inventory every Chromium-based browser and runtime. Include Google Chrome, Microsoft Edge, Opera, and any application embedding Chromium or V8 (Electron apps, headless browser automation, CI runners, and container base images). Record version, owner, and internet exposure for each asset.
- Patch to the fixed build. Upgrade to Chromium/Chrome 152.0.7977.82 or later per the vendor's stable channel update. Apply the same update cadence to Edge, Opera, and any downstream Chromium consumers.
- Apply mitigations where patching is not immediately possible. Follow vendor instructions and CISA's BOD 26-04 guidance. If mitigations are unavailable for a given asset, evaluate discontinuing use of the product for that use case.
- Verify the fix. Confirm the reported browser version on endpoints, golden images, and cloud-hosted browser services. Re-scan after deployment to catch assets that missed the update.
- Assess exposure and triage. Evaluate each asset's internet exposure and follow CISA's Forensics Triage Requirements for BOD 26-04 implementation. Prioritize internet-facing and user-facing browser sessions.
- Close the ticket with evidence. Attach version confirmation, asset coverage counts, and any exceptions with compensating controls. Document the remediation date against the 2026-09-18 deadline.
FAQ
Is CVE-2026-85046 in CISA KEV? Yes. CISA added CVE-2026-85046 to the Known Exploited Vulnerabilities catalog on 2026-09-04.
What is the CISA due date for CVE-2026-85046? The federal remediation due date is 2026-09-18, giving organizations a two-week window from the KEV addition.
Is this vulnerability internet-facing or remotely exploitable? Yes. The attack vector is network-based (AV:N) and requires user interaction (UI:R) — typically a victim loading a crafted HTML page. Any internet-connected browser session is a potential exposure point.
Is CVE-2026-85046 tied to ransomware? Known ransomware use is currently listed as Unknown. Absence of a ransomware association does not reduce urgency given the KEV listing and public PoC references.
Which products are affected? Any browser or application built on Chromium V8, including Google Chrome, Microsoft Edge, and Opera. The official summary specifies Google Chrome prior to 152.0.7977.82.
What is the CVSS score and EPSS score? CVSS is 8.8 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS is 0.01462 at the 0.72319 percentile.
Are there public exploits? Yes. Multiple public proof-of-concept references are circulating on GitHub. Treat exploit availability as confirmed and prioritize patching accordingly.