CVE-2026-85046: Type confusion in V8
Chromium: CVE-2026-85046 Type confusion in V8
Other sources
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
— CISA
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information. Google is aware that an exploit for CVE-2026-85046 exists in the wild.
— Microsoft
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
— MITRE
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 152.0.7977.82 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 152.0.4191.62 - Upgrade
Upgrade
Google Chrome / Chromium (V8)to a version that resolves this vulnerability.Fixed in 152.0.7977.82Patch CVE-2026-85046 - Upgrade
Upgrade
Microsoft Edge (Chromium-based)to a version that resolves this vulnerability.Fixed in 152.0.7977.82Patch CVE-2026-85046 - Compensating control
Evaluate each affected asset’s internet exposure per CISA BOD 26-04 Prioritizing Security Updates Based on Risk guidance; for internet-exposed instances, prioritize rapid mitigation/patching. If mitigations are unavailable, discontinue use of the product.
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Which Chrome versions are affected?
Google Chrome versions prior to 152.0.7977.82 are affected. Update Chrome to 152.0.7977.82 or later.
What does an attacker need to exploit this vulnerability?
An attacker needs to induce the target to process a crafted HTML page remotely. Successful exploitation allows arbitrary code execution inside the Chrome sandbox.
Is there evidence of active exploitation?
Yes. The vulnerability is flagged as exploited and was added to the KEV list on 2026-08-04.