CVE-2026-85046

HIGH8.8

CISA KEV

Published 2026-09-03 · Updated 2026-09-21 · Source chrome-cve-admin@google.com

Summary

CVE-2026-85046 is a high-severity (CVSS 8.8) vulnerability in Google Chromium V8. CISA added it to the Known Exploited Vulnerabilities catalog on September 4, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 18, 2026. CISA does not currently list it as used in ransomware campaigns. Google has 75 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 75 known-exploited Google vulnerabilities →

Description

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-843

CISA Known-Exploited Vulnerability

Product: Google — Chromium V8

Name: Google Chromium V8 Type Confusion Vulnerability

Date added: 2026-09-04 · Due: 2026-09-18

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

View on NVD

More exploited Google vulnerabilities

Most recently added to CISA KEV

CVE-2026-58704
Pixel — Google Pixel Improper Authorization Vulnerability
added 2026-09-16
CVE-2026-87491
Chromium V8 — Google Chromium V8 Out of Bounds Write Vulnerability
added 2026-09-09
CVE-2026-11645
Chromium V8 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
added 2026-06-09
CVE-2026-5281
Dawn — Google Dawn Use-After-Free Vulnerability
added 2026-04-01
CVE-2026-3910
Chromium V8 — Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
added 2026-03-13
CVE-2026-3909
Skia — Google Skia Out-of-Bounds Write Vulnerability
added 2026-03-13

View all →

Related CVEs

Same severity, most recent

CVE-2026-112368
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
2026-10-19 · score 7.5
CVE-2026-112366
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
2026-10-19 · score 7.5
CVE-2026-112309
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.
2026-10-19 · score 7.5
CVE-2026-112308
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.
2026-10-19 · score 7.4
CVE-2026-112307
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
2026-10-19 · score 7.3