CVE-2026-85046

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Sep 21, 2026

Description

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Vendor	Product	Versions
Google	Chrome	>= 152.0.7977.82, < 152.0.7977.82

References

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/542403045Permissions Required
https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.mdExploit, Third Party Advisory
https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67Patch
https://news.ycombinator.com/item?id=49570669Issue Tracking, Third Party Advisory
https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046US Government Resource

Timeline

Published: Sep 3, 2026
Last modified: Sep 21, 2026
Added to CISA KEV: Sep 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-850479.6Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentiall CVE-2026-850488.3Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to CVE-2026-850498.8Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a CVE-2026-85059.8IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger CVE-2026-850509.6Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outsi CVE-2026-850518.8Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox CVE-2026-850523.1Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer proc CVE-2026-850538.8Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code insid CVE-2026-850557.1Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on select CVE-2026-850568.2ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password v CVE-2026-850578.7ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compati CVE-2026-850587.5Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through