CVE-2026-85046 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: USER_INTERACTION

CVE Published: 2026-09-03

Added to CISA KEV: 2026-09-04 1 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — CISA KEV LISTED: This vulnerability is confirmed actively exploited. Treat as an emergency patch. Enforce Chrome update to version 152.0.7977.82 or later across all managed endpoints immediately via your endpoint management platform (Intune, SCCM, Jamf, etc.).
INCIDENT RESPONSE: Review proxy/web gateway logs for unusual outbound connections to newly registered or low-reputation domains around and after the disclosure date (2026-09-03). Look for indicators of compromise on endpoints that may have visited malicious pages before patching.
THREAT HUNTING: If Chrome Enterprise is deployed, query telemetry for renderer process crashes or anomalous child process spawning from Chrome, which may indicate sandbox escape attempts chained to this vulnerability.
PATCH PRIORITY — CRITICAL: Update all Chrome installations to 152.0.7977.82 (Linux/macOS) or 152.0.7977.83 (Windows) or later. Do not rely on auto-update alone in enterprise environments — verify via asset inventory.
MITIGATIONS WHILE PATCHING: Consider enabling Chrome's enhanced sandbox mode or Site Isolation settings. Block access to known malicious domains at the proxy/DNS layer. For high-risk users (executives, finance, IT admins), consider temporary restrictions on browsing unknown external sites.
MONITORING: Alert on Chrome version compliance via your endpoint detection platform. Browsers below 152.0.7977.82 on internet-connected endpoints should be flagged as critical compliance failures given KEV status.
SCOPE NOTE: This is a CLIENT-SIDE risk, not a server/infrastructure risk. Prioritise endpoint patching over server-side mitigations. Server teams do not need to take direct action unless they run headless Chrome automation on internet-accessible infrastructure.
CHAIN AWARENESS: V8 type confusion exploits are frequently chained with sandbox escape vulnerabilities to achieve full host OS compromise. Monitor for related CVEs in Chrome's sandbox or OS kernel that may be used in conjunction with this flaw.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-85046 is a high-severity type confusion vulnerability residing in V8, Google Chrome’s JavaScript and WebAssembly engine. The flaw allows a remote attacker to execute arbitrary code within the browser's sandbox environment by tricking a victim into visiting a specifically crafted malicious HTML page. Because it permits remote code execution through standard web browsing, this vulnerability poses a significant risk to the integrity and confidentiality of user data on affected systems.

Exploitation

Active Exploitation: The vulnerability has been confirmed as being actively exploited in the wild.
Threat Actors: While specific advanced persistent threat (APT) groups or ransomware campaigns have not been publicly named in association with this specific zero-day, it has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active use by malicious actors.
Proof-of-Concept: Publicly available exploit code is not standard, but the existence of active exploitation confirms that functional exploits have been developed by attackers.
Prerequisites:

- Network Access: Remote (the attacker must host or redirect the user to a malicious webpage). - Authentication: None required. - User Interaction: Required (the user must be enticed to navigate to the malicious HTML page).

Affected Products & Patches

Affected Versions: Google Chrome versions prior to 152.0.7977.82.
Patch Availability: Google addressed the vulnerability in the stable channel update released on September 4, 2026. Users are urged to update to version 152.0.7977.82 (or later, such as .83 for Windows/macOS) immediately.
Mitigations: There are no known workarounds for this vulnerability other than applying the official security update provided by Google.

Impact

Access and Capability: Successful exploitation allows a remote attacker to achieve arbitrary code execution within the browser's sandbox. This can lead to the unauthorized execution of malicious scripts, potentially compromising user credentials, browsing sessions, or sensitive local data.
Business Risk: For internet-facing deployments and enterprise environments, this vulnerability represents a critical risk as it provides a pathway for initial access or malware delivery to endpoints. Unpatched browsers can serve as an entry point for lateral movement, data theft, or further system compromise within an organization's network.