CVE-2026-85046: google chrome, google v8

CVSS 8.8 (high) · listed as exploited by CISA since 2026-09-04 · published 2026-09-03

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected products (NVD): google chrome, google v8

Fixed in (NVD): 152.0.7977.82, 15.3.48

Weakness: CWE-843

Source: NVD CVE-2026-85046

References

• https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html
• https://issues.chromium.org/issues/542403045
• https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md
• https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67
• https://news.ycombinator.com/item?id=49570669
• https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.