Glonce

Chrome fixes actively exploited V8 sandbox bug

securityThe Glonce editorsHacker News🔥74Glonce rating74Impact85Novelty60Relevance35Surprise50Players85Credibility95

On September 3, 2026, the National Vulnerability Database published CVE-2026-85046, a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. According to the NVD description, the flaw affected Chrome versions before 152.0.7977.82 and allowed a remote attacker to execute arbitrary code inside the browser's sandbox by getting a victim to open a crafted HTML page; triggering it required user interaction. NVD rated it 8.8 out of 10 on the CVSS 3.1 scale (high severity), with an exploitability score of 2.8 and an impact score of 5.9; the attack vector is network based with low complexity and no privileges required, and confidentiality, integrity and availability impacts are all rated high. Chromium's own security team separately classed the bug's severity as high.

On September 4, 2026, CISA added the flaw to its Known Exploited Vulnerabilities catalog under the name "Google Chromium V8 Type Confusion Vulnerability." CISA's own assessment marks the exploitation status as active, describes the bug as not automatable, and rates its technical impact as total. The agency set an action due date of September 18, 2026: under Binding Operational Directive 26-04, federal stakeholders must apply Google's mitigations, meet CISA's forensics triage requirements, and for cloud services either follow BOD 26-04 guidance or discontinue use of the product where no mitigation exists.

The fix is Chrome version 152.0.7977.82, referenced in the CVE record's links to Google's stable channel release notes and the underlying Chromium issue tracker entry. The NVD record does not name a researcher or reporter, does not describe how the bug is being exploited in the wild, and does not state whether other Chromium based browsers, such as Edge, Brave or Opera, are also affected. It is also narrower than how the story circulated online: the record bounds the flaw to Google Chrome versions before the fixed build, not, as one discussion thread's title put it, "all Chromium versions."

Key facts

  • CVE-2026-85046 is a type confusion bug in Chrome's V8 engine, fixed in version 152.0.7977.82, letting a remote attacker run code inside the sandbox via a crafted HTML page that requires user interaction to open.
  • NVD scores it 8.8 out of 10 on CVSS 3.1 (high severity), with an exploitability score of 2.8, an impact score of 5.9, and high impact on confidentiality, integrity and availability.
  • CISA added the bug to its Known Exploited Vulnerabilities catalog on September 4, 2026, rating its exploitation status as active and its technical impact as total.
  • CISA set an action due date of September 18, 2026, requiring mitigation under BOD 26-04 or discontinued use where no fix is available.
  • The NVD record does not name a researcher, does not describe the in the wild exploitation method, and does not say whether other Chromium based browsers besides Chrome are affected.

Why it matters

A remote code execution bug inside the sandbox of the world's most used browser is confirmed to be under active exploitation, not merely a theoretical flaw. Chrome's sandbox is meant to be the last line of defense between a malicious webpage and the rest of the operating system, so a working exploit turns a single crafted HTML page into a code execution path confined inside that sandbox. That is why the CVSS score lands at 8.8 and why CISA moved to add the bug to its Known Exploited Vulnerabilities catalog within a day of the CVE's publication.

Who it affects

Anyone running Google Chrome before version 152.0.7977.82. Federal U.S. agencies face a formal deadline: CISA's directive requires them to patch or otherwise mitigate by September 18, 2026, or stop using the product. The NVD record names Google as the vendor and Chrome as the product; it does not say whether Chromium based browsers such as Edge, Brave or Opera inherit the same flaw, so their exposure is not established by this record.

How to use it

Update Chrome to version 152.0.7977.82 or later; the CVE record cites Google's stable channel release notes and the underlying Chromium issue tracker entry directly. Organizations subject to BOD 26-04 must apply the vendor's mitigation, follow CISA's forensics triage requirements, and for cloud services either comply with BOD 26-04 guidance or drop the product if no mitigation exists, all by the September 18, 2026 deadline.

How solid is it

The record comes from NVD and CISA, two authoritative government sources, not a blog post or a rumor. It carries a full CVSS 3.1 vector, an SSVC exploitation assessment of active, and a formal catalog entry with a mandated action date, all signs that the bug has been analyzed rather than merely reported. It does not, however, name a security researcher, so the record itself does not document independent confirmation of how the exploitation was first observed.

Risks and caveats

Exploitation requires user interaction, meaning the attack only fires if a victim opens the crafted page, so it is not self propagating on its own. The record gives no detail on how the bug is being exploited in the wild, no attacker identity and no victim profile. It also neither confirms nor rules out impact on Chromium based browsers other than Chrome, and despite how an online discussion thread framed it, the NVD description bounds the flaw to Chrome versions before 152.0.7977.82 rather than all Chromium versions.