Actively exploited · Published Sep 3, 2026 · Assigned by Chrome

CVE-2026-85046

High 8.8 Exploited

In plain English

A high-severity type confusion in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on September 4, 2026). The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.8%top 21.3% of all CVEs

Exploited in the wildYesCISA KEV since Sep 4, 2026

Attack tooling1Public PoC

CISA guidance

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Federal agencies must remediate by Sep 18, 2026.

Official description

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	chromium	152.0.7977.82-1~deb12u1	DEBIAN-CVE-2026-85046
Debian:13	chromium	152.0.7977.82-1~deb13u1	DEBIAN-CVE-2026-85046
Debian:14	chromium	152.0.7977.82-1	DEBIAN-CVE-2026-85046

Affected products (as reported)

Vendor	Product	Versions
Google	Chrome	152.0.7977.82 – before 152.0.7977.82

Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H